{ "Event": { "published": true, "date": "2023-03-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-30", "timestamp": 1680220982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8d09e331-d51f-403f-91ee-4f5d0cca21be", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a2f816-cec8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680159510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159510, "uuid": "92705400-42ae-44b9-892a-eafab52aed6b", "comment": "Malware payload (AgentTesla)", "value": "d2cc17410cd236454d572513da837edf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159510, "uuid": "9bd842f1-4424-42e1-8ff0-4bb2224bc890", "comment": "Malware payload (AgentTesla)", "value": "0000e8bfdd41e01fb3d36315502ac76c5553905a3abdd6acf741c1d633cbd6a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159510, "uuid": "dc293c1c-50be-41e0-bcfe-f77fb5c17cfd", "comment": "Malware payload (AgentTesla)", "value": "457a05831c9cfd14450f7b967cc7a319aac2ac75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159510, "uuid": "eb196b9c-e31b-455d-a70a-6f0d5ca1235d", "comment": "Malware payload (AgentTesla)", "value": "dee465e04e569c5eefef5ea8ff9a150aa0f86688ca6c55816930f4502ffa76ae77a69f65a63671b2629adf3e27385887", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159510, "uuid": "175a1a0d-f43f-4af2-a1c2-62fdf768077f", "value": "T132359C59E18071FFDA274772C5D1E733A26FEED9166189CDD8E43DA7B2FB208001A606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159510, "uuid": "36488b85-9c14-4285-ae7c-da97f7c68e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159510, "uuid": "d9f3d117-8772-438b-ac24-b768bbccb8a9", "value": "12288:WZ2iNo3XdJVZz5dB3mt9gpp2Ii+y2m+2LIs4BoQtb4gUosBIkXDe9dpcKAp56p:WZ12zVZ97mIvbDy2CnU4gUpBIkyA+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159510, "uuid": "419d0da6-861d-4089-8da4-485788c3bf88", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159510, "uuid": "2d4b8bbd-5308-44f9-9f2e-e5ae259b252f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159510, "uuid": "5041c6d3-550c-4561-8925-46d7a85e2722", "value": "prodotti nuovo ordine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03f802f-ce92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680136493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136493, "uuid": "cac8ee72-4fa8-4dc1-9e91-e4bcdf51a4b5", "comment": "Malware payload (Amadey)", "value": "363fe2a2f81e70d676809132e83c5320", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136493, "uuid": "a86722cf-9833-469b-b642-f69ada1cbbb6", "comment": "Malware payload (Amadey)", "value": "01e45abb29d308bb9402e7a7509bbd39fcf51fae5962fb40fcd13a04b6a87afd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136493, "uuid": "545d8a55-c407-46ac-a0aa-59ed1f289a99", "comment": "Malware payload (Amadey)", "value": "1a969aee5858b4196d08c684abf983944c8b0fb3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136493, "uuid": "bfe8199f-b433-4692-a444-7412d1a465b4", "comment": "Malware payload (Amadey)", "value": "415f64c5c2f5a6b3e729ff934b8eecb2aee038dc00ec5ae7bd970870a732b0246589f354f1281ec356c4844b5d1f45fe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136493, "uuid": "db6e50bc-0a98-4392-bdca-87334de0c6a8", "value": "T12A44C0A2BF91C472D41E49794811CBB45E3BBC304B658ACB6794D77E4E343D28B36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136493, "uuid": "dc091697-5a11-429b-bd5d-dfcc705103c0", "value": "fde2d3c5c6b5080c428e56f6f2289988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136493, "uuid": "005f8d28-cbb5-4eca-96b9-d8e1a3f3e37c", "value": "3072:Ib7i8FXgN8XvlsEILOoPnhoDyfaOoPAZN3Egr7lee3CB4dw4xAr:G+853vlsRLO4hEUaOoPkrrHvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136493, "uuid": "5f9ca6d5-33c8-4b0f-8126-0b4e57392b4f", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136493, "uuid": "d21a0493-1296-4a27-9626-fc9640ac08b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136493, "uuid": "a110f60f-4de1-4dda-918d-1e565d7e6fac", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46fddaf-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170887, "uuid": "a3c0de03-98ee-4b56-b5c9-4545609e6de8", "comment": "Malware payload (Mirai)", "value": "611d06eaf04f0e6201b99407c8baa1ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170887, "uuid": "eec18add-beb8-4f49-b130-9a6e33c1155f", "comment": "Malware payload (Mirai)", "value": "02a7b6a9fcc1d7822456046b3dde6f847ef64993e6670392295c4d83472ac639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170887, "uuid": "07d596ff-9242-4da8-9898-61eedd1bfdef", "comment": "Malware payload (Mirai)", "value": "16f1019ba1adf513030f633916528f2720e6ccb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170887, "uuid": "04ff6339-21eb-483b-bd6b-c2379e46c49f", "comment": "Malware payload (Mirai)", "value": "0c2f19e1341ae78c1a7f43ac8fb39e2d8195c87575d7846fa7d567d8c7b8088b40ac0344fe69a635752909e96df1ba2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170887, "uuid": "b2234cb2-b689-400b-9ccb-3712f316ede0", "value": "T1E2632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170887, "uuid": "1e9d34dd-6e17-4a0d-adbe-79f474837cb1", "value": "1536:lGBVg7AOotXhGIAsQXt3ASQlQm75YH/tatwV:lSCzxBgQmVNOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170887, "uuid": "77a0936a-c469-4c57-a168-a2bf5eaa780f", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170887, "uuid": "b7013533-2189-426c-bb93-1028fe1a49a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170887, "uuid": "1ad546bc-acaf-4aba-83ad-af72816b383f", "value": "611d06eaf04f0e6201b99407c8baa1ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aa4ad5-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680160990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160990, "uuid": "f83825c5-964f-4001-83df-bb27aeb16f04", "comment": "Malware payload (AgentTesla)", "value": "6c3555000c4161d62d5f0724acc9b419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160990, "uuid": "1855e5a7-0725-4e6a-92aa-3f69afb0dcd8", "comment": "Malware payload (AgentTesla)", "value": "05e63f22ad65bcec1b78d424524758d4466dd9d9e1f9d51762bb6141184aceb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160990, "uuid": "fc7fe598-58ad-4e3a-85d9-a1d2c2aef508", "comment": "Malware payload (AgentTesla)", "value": "0a2879e0ba580a91b4f91004947743dc4af0ac0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160990, "uuid": "c5ec1919-b7af-449f-8e10-11e7d6eba5dd", "comment": "Malware payload (AgentTesla)", "value": "20f647a84ea0738afe2aacf3b4be447f8e46ebd69bebbf94ae7b09257e921acff5b1d763669a8a4ed7f88aa40c77e26f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160990, "uuid": "093a9cb1-4e87-4be5-8d68-0658c0c0bd3d", "value": "T1F7F3182CB2859DD2D72D4074E8A01158CEB29147C617E79F0EA0A8F63F47793762F9A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160990, "uuid": "1e6c51b2-4e20-4561-9951-35f6fc7f6e0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160990, "uuid": "7985964b-e2c8-43d5-a98b-c25ad85fed90", "value": "3072:rLmEPHGbI8Xu1O63QgO7Gw/Og5H4kzSHc5wQp9KxovdEHTQQzTB2U8ef:rLPHKIxr3Qg7wnSkSHc5Ox+ShwU8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160990, "uuid": "d3877f6b-9bb1-4ec2-bb04-884b896ef66a", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160990, "uuid": "9b26abbc-9b0c-499f-b6d5-32bcd3d6d885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160990, "uuid": "3d366a6e-ee21-46ec-8d5d-d61d5434b175", "value": "main_payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bde1a6-cede-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680169142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169142, "uuid": "813d8f0d-0bbe-473d-b3fe-24e4f073500a", "comment": "Malware payload (Formbook)", "value": "438f1ee2a9759fb02c5aaf3f13217ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169142, "uuid": "21ccf86f-5336-47ac-bd3e-4431facdf698", "comment": "Malware payload (Formbook)", "value": "06bae25e92bc3fac52c2c12ef0540fc44a3d254a7214fa5875b721c04a62b787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169142, "uuid": "b8242e7e-400b-40a0-a07b-ba91b1413fec", "comment": "Malware payload (Formbook)", "value": "5dd415ce94ebe140803d21430a35a5322947d8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169142, "uuid": "3480907c-9808-41da-a64e-c66cd0d34bad", "comment": "Malware payload (Formbook)", "value": "ea1d92f0da5361970aa4821498a2f554fc5739eca01e28113e1d789b44bb4a949b4116e815c478b077cd68d4b4d15c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169142, "uuid": "29977870-e279-42ef-bcb8-6b0d7974ddfe", "value": "T19D54130852E4C1E7C07206B79E752B1A6FFCBA151AF893874741729EFA273A2C90F750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169142, "uuid": "91d65184-b0d7-4842-b9c9-f087b641b6c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169142, "uuid": "3cd5646c-0122-432a-bbb7-6c0103beef4f", "value": "6144:/Ya6rKlWBRUKU3HgJFjdb8mWkcdQSVfwCSkNgi7GflDlwcR4:/YBKlIlU3AJvVC5NgVFlwi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169142, "uuid": "186cc5d0-afc6-47ca-b4d8-7f4d878780bb", "value": 287580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169142, "uuid": "eb8f2527-b96d-495c-8de6-c0047fe73be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169142, "uuid": "cfa67375-ad5e-496e-b2a0-2d529feaa124", "value": "issu_20232003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb28835-ce95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137613, "uuid": "41e463b7-14cd-4c28-b1a3-e23f4f5e31a5", "comment": "Malware payload (Smoke Loader)", "value": "8b195a2c5b97233c10db42673b1d768a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137613, "uuid": "6840ec06-04ba-40b5-afb1-298c31f7d95f", "comment": "Malware payload (Smoke Loader)", "value": "0799ce03ecc364e4b4a01384f3106d3889e411b00026c4d1794e28ed0ff029c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137613, "uuid": "b2b6b125-0af2-4dd5-8344-5953d67c3966", "comment": "Malware payload (Smoke Loader)", "value": "24d82b00fdb7f0a6dbc6bbf9a3824421f17c7b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137613, "uuid": "a6b4770f-9442-4f9f-80ce-e9e5426c03ff", "comment": "Malware payload (Smoke Loader)", "value": "d3328ec484af654ce4e0135781d1b1ce88b918ea83df4f66a0a9c14835308bf2b2a9d29bb24c9629dc1e23a1057a9fea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137613, "uuid": "54bcadad-266b-42df-9714-210e4eb6a673", "value": "T1FC34C0227792C472D61B00794811CAFC5A7B78708B158AC72BC45BBE4E367D39B3A74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137613, "uuid": "3660c12f-e5ea-44fa-a8e2-81fbc8c12866", "value": "248089891092684f7229c494995977e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137613, "uuid": "a5e43beb-432b-4414-a506-edf8e43c3c4b", "value": "3072:z1M5aN9+LcRjwEx7G7SW+3onDWjdrNaXQK6tDwXOLYVJW05fzN9/:y5K+LcNxsSWpI1K6CecVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137613, "uuid": "02128e2b-5609-4e44-a9c1-e4ae2d6f0f87", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137613, "uuid": "d8470127-a8f0-42a9-adbe-dca01b4e87d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137613, "uuid": "67bfd483-bfee-4de8-8520-c91b4a589c27", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302104c2-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180516, "uuid": "d20aef05-f98f-44b3-9845-a703e17556c6", "comment": "Malware payload (AgentTesla)", "value": "7f4bdf10b229dc6ac432937b3f786752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180516, "uuid": "318e0aea-0a26-4f43-a4e4-c895d0211e74", "comment": "Malware payload (AgentTesla)", "value": "07cbd8a3deb941e46404af8b1093168b4029ce8f36e4ec18844ede50268602e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180516, "uuid": "0b17a651-28ca-49fe-8cac-4db6d170bfe4", "comment": "Malware payload (AgentTesla)", "value": "09204b9e950f947240a37cdb0f2215b556398c3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180516, "uuid": "858ed832-e580-403b-af20-a09391f57611", "comment": "Malware payload (AgentTesla)", "value": "c781008e192a1b3a8a8d4af375af6189ef3e4fe963acf67a7d03e40aa8aad8642d1977d25eb4752c7e3be77149adf946", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180516, "uuid": "28bb7748-551e-45de-94a1-4f876820107a", "value": "T118F4011437D9D20AD02E877AC1E5D6B0A779CCD9D692C7231FD9BDC3B78E381A52018A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180516, "uuid": "f14b9812-c995-4820-bf1c-f2633f2f9944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180516, "uuid": "6277a802-37d6-4c24-85cb-b4fe36184b78", "value": "12288:evf7CX984M74c9vU+q2Hl3ZaZgjMTwuWevgoMbmxSTvS/04lK0KimOMt+:e3l4M7r9cGH7qgokKvgD1YKimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180516, "uuid": "5df0e747-7ee6-438e-b091-960f41cb54e6", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180516, "uuid": "7e3d174e-e212-451f-a54d-56a9876427af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180516, "uuid": "4de950e7-1dfd-486c-a2c8-54cb8a7c10b0", "value": "30.03.2023_SWIFT MT 103_9078212345TRF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a314a7d9-cf0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680188440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188440, "uuid": "26c5b35f-6c45-4cc7-9228-1a0113716521", "comment": "Malware payload (RedLineStealer)", "value": "a37ff4d54200fa7711750145c9142e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188440, "uuid": "e35775c9-2334-465a-9cc2-25e2febf2ca2", "comment": "Malware payload (RedLineStealer)", "value": "0808d65d091aba9c00a2d408dcebd37373d2abaf155a82991486b57cb88aeb79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188440, "uuid": "62c1de10-4f56-4c63-95e4-a7f552522ec2", "comment": "Malware payload (RedLineStealer)", "value": "638c844a99bc3955032a362d83cbcea20fcd855d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188440, "uuid": "059f133d-6acc-49aa-a835-59be8a6aece5", "comment": "Malware payload (RedLineStealer)", "value": "e9c8f8e4f1771220e7f3cdea29a19cbcf903f6e8d8c25d76bcddaa621c6490890df371abab2490774f7bc437b1a89fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188440, "uuid": "1d8f50f9-7088-424c-9d4a-7d4768e26847", "value": "T16C652212B6E289F2D52218324D28B721797CBD301F209D6FA7DD9E1CC536191673ABB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188440, "uuid": "e3bc5d60-b2ee-4813-b6f4-f4ed016a19d0", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188440, "uuid": "a35ed740-cde5-4c9a-845e-600cefb06f40", "value": "24576:1XhZgPloukiPngm5oiwM1jnu8/S1fOXCgER2aHgbcYpPy4mG5G6Iok++OCc3Zx4X:VIfkIgm5oi5q8/S1k07gw+z/TMWZx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188440, "uuid": "7ce5d9d8-df0a-47eb-a19c-df9c16e79090", "value": 1454135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188440, "uuid": "1bc075af-43d0-4e28-a43e-552bc479cb74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188440, "uuid": "9ffbc26e-c6ba-43da-9cf4-92ed16ce7889", "value": "a37ff4d54200fa7711750145c9142e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3224151-cecf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680162805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162805, "uuid": "fa46de54-f38b-4fa2-8fdb-686fa72cb9f4", "comment": "Malware payload (AgentTesla)", "value": "ac85335afe1237e78ba86beb2950c3bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162805, "uuid": "8bc72dc0-e7f2-41d8-87fc-8d07794869a0", "comment": "Malware payload (AgentTesla)", "value": "09606aab0e4d6b1ad408da37e0245df53c5769960e8f1aca6e12b6ab979ed4c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162805, "uuid": "f10b9a4a-49b8-41d9-a28a-9b5afb76fd03", "comment": "Malware payload (AgentTesla)", "value": "7ecdd418b3a15a858f86776969da3a3b0e04f9dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162805, "uuid": "38df21f8-22dd-42b4-ae09-d9cf5ebf7b17", "comment": "Malware payload (AgentTesla)", "value": "5e334f4fa4d00c2687584c1569b0ce7fd8b6eb37385d9140e795298b5f7008b24271d9eee959ad98166a458867b71acb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162805, "uuid": "040d9375-5649-44cf-9558-12c548a1bf6d", "value": "T1ACD4CF90D198ECE6D5073075BC3EE562291BAE1F9778092A332A7D2575B3383247AD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162805, "uuid": "8ec0cd9f-a474-4733-b6e0-bd58809d8053", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162805, "uuid": "bd482ec5-befc-4d43-beed-69a4a5b63de6", "value": "12288:1rAEtSq41AlJzRM+hAxPa3lRgG6xZxzyVLehCFBAx:1rAEYq4WfdMLNa1U/zy1ehCvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162805, "uuid": "d68aba3e-c117-4c12-ad53-efa0eb4f38a9", "value": 643768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162805, "uuid": "47e6d47e-e9c4-4fdb-83f8-1d72faa4217e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162805, "uuid": "0865e953-8eba-409f-b6e6-e54b6c9ac8bb", "value": "Tordenbygen72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa209b2-cf0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680188300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188300, "uuid": "5dd658c8-9991-4c62-b42d-57e13114a1e4", "comment": "Malware payload (AgentTesla)", "value": "b34b2e21f7689e00f4efbda92e4c3281", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188300, "uuid": "5917fa6f-7936-4a8e-87a4-3b5a0c9ff237", "comment": "Malware payload (AgentTesla)", "value": "09bd787629b10675551fb0abffda6a4c8180a202cc5f6249e88598a570e6e4f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188300, "uuid": "0643e20a-8d58-4679-9dfb-3356b8ccdc13", "comment": "Malware payload (AgentTesla)", "value": "94ac67f8cc89ad76584cc50b417f34f9a9f6966d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188300, "uuid": "d97c7657-81df-45b0-a283-c203519bc49b", "comment": "Malware payload (AgentTesla)", "value": "aaf06fd9c97777286349a9d6d63e73795335e961e08d62afc309064f0eb6f5226575ab4a12a39da4a6de89d1bce71335", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188300, "uuid": "46339123-e123-4518-b746-698a38fd4af3", "value": "T115A529F20293FDC5D72F1EB980482940AC041AA797BC9648FCCD6697A3ED554EF6C6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188300, "uuid": "3aa13765-1d8f-40f1-ace2-c8515314bfda", "value": "24576:qPbG3Ktu1Dze6HDpLsX6FTqliEBQYKDLWFZ79rWvOBrAQp/8/zZcrGSPa8k0+oi9:qPO3ECalGIUT1ldg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188300, "uuid": "c5a46155-aa7e-4e5c-ab08-5ebd7668e73b", "value": 2125824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188300, "uuid": "02fe1151-72e1-475f-925d-2902955a5a46", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188300, "uuid": "cfe590c6-2200-460e-80c8-8d6b208a290b", "value": "New Catalog and Prices.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7f6c38-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161287, "uuid": "5b3e300b-51b0-4702-b2c2-2524160d2f25", "comment": "Malware payload (AgentTesla)", "value": "1221cb26fce645461d0860112d337983", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161287, "uuid": "37cdc3fd-e9ef-48eb-bc00-71a497f87380", "comment": "Malware payload (AgentTesla)", "value": "09cace5c1d4ab4bc5a322975f77b7bf5edcdb90327105448d2d9fbed6bd7a78e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161287, "uuid": "9bc3e8b3-6b0d-4873-9a0d-dddd1e570b0e", "comment": "Malware payload (AgentTesla)", "value": "de30b471999203b5ae46216ccd2a72d91514cb6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161287, "uuid": "f00317e6-3af3-4aa7-83e6-3114570f4ae3", "comment": "Malware payload (AgentTesla)", "value": "c9bc808758c88f7ccefd202e3bb4f92c200dfc74f9b845347516f4205997db0bfeeb97be4e5d7ae82cd91a58bb7e5410", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161287, "uuid": "5b1de8f4-8001-4a04-b037-22eb64bbf2f1", "value": "T163A498613AF670283EF139079FA7F60983B697C6583ADD5E09DD051A42FE040A1E1BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161287, "uuid": "cd7b5d06-2ab9-4a88-91e0-1809287d030c", "value": "1536:j89r/aDcWJwG0mtvR/Eg5vSdlKk9b2k82JS88TMqZ:Ktmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161287, "uuid": "9f155087-cccd-4e0a-abc2-cb70d50fc6b9", "value": 479722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161287, "uuid": "2e204ec4-b7de-4029-9952-c3060fc0206e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161287, "uuid": "f4e9aff9-e4c7-41a6-b8c3-59aba3bc0831", "value": "PLD094-5421.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8765b23-cede-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680169229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169229, "uuid": "59628dde-7f2e-453c-8ef5-8cf9328e2009", "comment": "Malware payload", "value": "d27da9380b8318ffafdfaaa073ff2406", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169229, "uuid": "5dbf40cb-2a5e-482a-8359-f8c4a1c94c8c", "comment": "Malware payload", "value": "0a192f7365cbe905554c04c199ecd43d31ea21e5aa2939eace22b59e29715319", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169229, "uuid": "80f5c721-bfc2-47a7-bb69-4cafda9e818a", "comment": "Malware payload", "value": "e4e27bde230da7a68cc5b533c56e76fb8685da55", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169229, "uuid": "c93ba690-71c1-4f92-bbdb-19119e2a7f28", "comment": "Malware payload", "value": "e0e2e71e00c1cad8aa498551410c9c77c8c27b80eaf7848f16ed6beb6bc37475cf05771c00a9fc6bef82910b90fc2c97", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169229, "uuid": "a8840fee-2703-4cb9-ae79-00082415e26a", "value": "T1AF2533845A969B1602B6A2B3E90CAC6F4E042E3F6F73BF3787F85148277A0125DCDD15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169229, "uuid": "b4ac7e3d-21de-4ffb-9ca8-ddf33be4a2a6", "value": "12288:+uXQ36xILh/NYWGRxu30sAXOfrbcqsp0Mk60khwQ+8qAJAWxgSNhkxbLW9dDlwHN:8TL56WQxOroqspNZqQCYl8YjOPWq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169229, "uuid": "3ebc9432-2cc9-4ff2-87e5-c1760e8b3c48", "value": 965570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169229, "uuid": "f0127ec5-8329-4508-9c59-41ea3ea11782", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169229, "uuid": "073ea4a0-3260-423f-9892-d3753877158e", "value": "HDFC Bank Return MT103.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117cb755-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680158990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158990, "uuid": "7c55c264-6df5-4796-8965-a44dba549d3d", "comment": "Malware payload (Formbook)", "value": "b2933dcc1154fd50fbb203ab9d4d2673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158990, "uuid": "fdc8ed91-d53f-49a5-8f0e-f36485014269", "comment": "Malware payload (Formbook)", "value": "0a39d2df6fe76fbf2e89e43f5f0ed05a48670fdcdd40a8651b4d74c6983286f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158990, "uuid": "aedda9b3-93c7-473f-b8bc-bbd289a1a0c8", "comment": "Malware payload (Formbook)", "value": "0aa3477dcbbd6b7b6dd80bee61a50799f03488d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158990, "uuid": "6cb25fc5-8969-411b-bec5-9d31490b0090", "comment": "Malware payload (Formbook)", "value": "198c330ff426d6b6365a2309528ea832d1d0543dc496c5321887e7b9aca6af3e19e016cd8872dcaa4daaa1f106050378", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158990, "uuid": "c504ced1-9d39-4ad6-b963-dd7b8e604c2f", "value": "T17A441251B978C473E4630E701B3E367EDFEE902A2838A25B47605F19BD23941E61F7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158990, "uuid": "1498ecda-0b37-4045-ad33-01fbe5ef6ea4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158990, "uuid": "c7324896-46bf-4e5f-bf64-8d8f3ae120d1", "value": "6144:vYa6iL741R/gnNiKzwz+1xVWUo9oJw1whsHMiroTxfIabGkzpE:vYcL7U/ElZPVWZYroMiroFIeGSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158990, "uuid": "2aa651ba-4184-43e6-9027-0085557a9907", "value": 254192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158990, "uuid": "b34e2c12-27b1-411f-a280-29e263f00a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158990, "uuid": "7104d510-bdec-4087-ad79-5b5ebc3a9089", "value": "PO_20230329.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd126f82-cefb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680181719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181719, "uuid": "6afee07d-81bc-49a2-b1dc-be1fd5578109", "comment": "Malware payload (AgentTesla)", "value": "80c0b9e8a00242d0fb960584d89d745e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181719, "uuid": "3cbaaf0c-5095-4206-9c5a-e69a166c9618", "comment": "Malware payload (AgentTesla)", "value": "0a8368bab522deb622eca5805bc7bc6da0d4a6a63fae959c41c22c7d0b5ffa63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181719, "uuid": "fa76137e-c6cb-480f-907a-d0cb78e1ad69", "comment": "Malware payload (AgentTesla)", "value": "fb6bb9c955f030eb906e532813f7c7c6102ec55e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181719, "uuid": "9335cc37-1104-4a4d-b6e9-4207e1ffc0d0", "comment": "Malware payload (AgentTesla)", "value": "3caba88a531cd243f6d39a24cd0d71eb53c330617ecc8d19331e464b93d33e5f2b064507f9077526ac9b629af846f2dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181719, "uuid": "99c400f2-ea65-4ed5-b300-e9a3eaf10d5d", "value": "T152F49D3C1BFC8556E139D7764BB44C30E7EDB417BA36CD1E79EA00850A26A42768336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181719, "uuid": "1b398fbb-c346-4e66-85c3-e5081ce64c6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181719, "uuid": "fb2aa33d-6ed4-48db-b93c-86dc0f04b277", "value": "12288:l3B2nTxM9+/nT92EiggkPIYP1QF7MKqv27bYyywV37Zb:lSbT92E8kPT1QFJ22GwVrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680181719, "uuid": "5597cb7e-7a43-4bf4-ae32-3356b3d399db", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680181719, "uuid": "afc60899-c4e1-44a6-9cb9-92875e8c92af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181719, "uuid": "71f1c05f-2e18-4ed2-824d-158fd9543bb8", "value": "New PO #23546738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286353a6-cf20-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680197254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197254, "uuid": "566bbe35-3cec-4372-9d2b-c0ba98efaf43", "comment": "Malware payload (AgentTesla)", "value": "de748901a7cfa64744266b9f0936e4dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197254, "uuid": "65edcc18-10e1-453b-a9c1-86e191a3e837", "comment": "Malware payload (AgentTesla)", "value": "0aff44dedb5c785c390593623803a17d3d7c435f2400180dde3ba4085af80e1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197254, "uuid": "c2eea5a5-e3d9-4eda-9eae-ea97e396ab18", "comment": "Malware payload (AgentTesla)", "value": "15d7a614564441c8f1dfcecb6a0e1336f3b870bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197254, "uuid": "8dccca0e-9fa0-4167-ba22-78ef78f05453", "comment": "Malware payload (AgentTesla)", "value": "f69ab41a969fd7d5bf2422b4e8fd6ba4836f6aa3be41fa1c4f7c96d85a0418e9ac518b126f63e520d85117cafd97636a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197254, "uuid": "58686ef8-b466-4e50-b0d1-6ce98bb83e44", "value": "T147A53AF20293FDC5972F1E8980482940AC041AA797BCD75CFCC96697A3ED554EFAC6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197254, "uuid": "0fca2ef7-dbb9-4148-89fb-896c69854435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197254, "uuid": "c429c73b-ed6b-44e4-bcb4-748e30e0eb56", "value": "24576:IPbG3Ktu1Dze6HDpLsX6FTqliEBQYKDLWFZ79rWvOBrAQp/8/zZcrGSPa8k0+oi9:IPO3ECalGIUT1ldg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680197254, "uuid": "42e5bc84-e866-43c2-b435-27774daefce4", "value": 2074112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680197254, "uuid": "fa885061-de11-44e9-b0a6-65a729b8c97b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197254, "uuid": "65b9994c-827f-4bdd-9952-3341e7a7aa0b", "value": "New Catalog and Prices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a561aaf-ceb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680150871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150871, "uuid": "d983336d-9732-4fe1-bdaa-415b9717ef38", "comment": "Malware payload (Formbook)", "value": "291a20fef6482b753cc6e9cc3d6bc292", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150871, "uuid": "3a5db0ae-a54b-4f6e-bdf9-ac9014d89370", "comment": "Malware payload (Formbook)", "value": "0b4d4ab86573d05f38f7d2fe83635c75da4462eacadd1859f00bdbdc3809f6fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150871, "uuid": "ee5685aa-6d5d-406b-992a-4a80b5bf4966", "comment": "Malware payload (Formbook)", "value": "0f7d584348f128345f1729c6a024f48ccbfd1baa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150871, "uuid": "9e2f32c6-4be1-485e-817d-fe4b90b79206", "comment": "Malware payload (Formbook)", "value": "92d165e458820f1eabb55379bc18e83d689ac31a14b8efa54f74866f714658c9e7eb9de8bfb430cbb75ae5ccbc03ea7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150871, "uuid": "d81400a3-be47-4b74-98e0-92bc97d28ed8", "value": "T1AB6412563BF4D4F7D871C9700F7196BABBB9EC0B2098074B23609B7A7C12E8A585E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150871, "uuid": "9e5780fb-052f-491a-b6ae-d39ab45c642b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150871, "uuid": "071f337b-eaa9-43a1-a2b0-a5f7cebe9101", "value": "6144:/Ya6Nf153sKWZQ1Le/vdTNsPWXtxRVTbweyLodo9vrY8sJzOcuL:/Ynf1KKW68s+b7YeyL4A4JqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680150871, "uuid": "62dea56b-57d2-42d0-8357-6acc0adf6f97", "value": 310884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680150871, "uuid": "1ecabb8e-99c9-43ba-9e76-f2f2f58c190c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150871, "uuid": "39e1bd2a-e58b-4f97-98b8-4a31c6b5151f", "value": "291a20fef6482b753cc6e9cc3d6bc292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93b9d3c-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680180746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180746, "uuid": "5965ba39-b8c2-4159-92f6-cffac92a0117", "comment": "Malware payload", "value": "f1d39c362370bf67d13cdf9cdcf67576", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180746, "uuid": "8d167edd-c8d7-4599-8109-b4314d451e57", "comment": "Malware payload", "value": "0b94af4c6fe7672140db01ba1f75fb6852f55d44da9133a3b74c9618e0e19f75", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180746, "uuid": "f5872034-2dc8-426f-9e14-0ed2c59d5681", "comment": "Malware payload", "value": "4545437da274852713dc98db8d7545cff490d7cb", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180746, "uuid": "d50273ce-89b8-4444-9ad1-6c4d28597c1d", "comment": "Malware payload", "value": "0c5e145b115f2c5c751c29c0fff54826b8c655a2a2fd9cb6263d89ed9e4eb0b8e4e5a14be54898d6c25456cb83254045", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180746, "uuid": "b4a45bc7-1b0d-4edd-805b-938c800c0e2e", "value": "T1B334E0177600CF83E055D3F87F838E9A2B42BF45A99235DB20807B5F6F3895259CA61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180746, "uuid": "a9b9ee4e-5c41-47e5-919d-6f783beea267", "value": "6144:0BaFJkKXiDU7w5r5EILRbe+6zwbn/0weN4PZYEyJedOD3l:eaFiKXK/nLVtr0weNMVJY3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180746, "uuid": "73588a66-5072-411d-ae3f-13e83bb5c692", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180746, "uuid": "6ff5c751-ed9f-47fe-acd3-7c9f66156965", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180746, "uuid": "2d6666f3-5359-44d5-b6c0-7386ba533c2e", "value": "PO_45920_Mar_GPR.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ce4f83-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161036, "uuid": "e400ebfc-5e87-4f21-a08c-9e9352e538a2", "comment": "Malware payload (AgentTesla)", "value": "9bf4f0b46a23e99393442dc592d42c4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161036, "uuid": "8cc3ab58-bce7-498a-9aa9-935865fee8b1", "comment": "Malware payload (AgentTesla)", "value": "0cec6fe99f27c7425eb235e531d19737ea94d3d15208d7533bb677fd2dd89794", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161036, "uuid": "f4a72655-a0ca-470b-a6ad-e365c6c7aaf6", "comment": "Malware payload (AgentTesla)", "value": "b052e1fbc186e2dbf1346645b30617166258be25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161036, "uuid": "7b1e147c-4a83-4e51-a842-436b436cf42b", "comment": "Malware payload (AgentTesla)", "value": "c35ba1adab618ed0e6b068b842033941c106c045993e0849c0ab3e40db52dd35d639c5b14bf3b6d39a29899c9ed9ed77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161036, "uuid": "63e91e04-7a1c-4c1f-acdf-3c7169676a86", "value": "T171552284ADB21AAF1EF08A32543F194C076EDFE54755E8CF12A966C1D44C3CBCA1B8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161036, "uuid": "33cb6ff1-6e79-439d-aeed-955fefebbd2f", "value": "24576:1EqwuOOvaG184TpPbDdiLpWKZDd6hKM0SsJ6IjV:Xwunv9AWKZ2sx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161036, "uuid": "7fc640d0-b84b-4d6d-a030-39d25ce56c93", "value": 1292753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161036, "uuid": "8fc3800f-0eec-4721-88f3-1a7d4f167eda", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161036, "uuid": "5209898b-d9cc-47ef-8470-e1ed510c88b2", "value": "Purchase Order_30323.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d744a4df-cedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680168771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168771, "uuid": "5ce66e06-adac-4123-ae20-a9efe9e399c7", "comment": "Malware payload (Formbook)", "value": "ac81ea2da46c405ae0cd752dcb99f975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168771, "uuid": "9d212226-8fde-45e7-b134-54ceb7b764ce", "comment": "Malware payload (Formbook)", "value": "0d870b6d00ecab33e548af14cc560c202edda83a38949d7686f289ca13a90ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168771, "uuid": "714a1867-9c09-4095-8780-d0911e1cfbba", "comment": "Malware payload (Formbook)", "value": "666841d072d3450fe6817264d269325730374b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168771, "uuid": "e7d5c8f6-6b49-4f0e-aa1a-c0ee51974c85", "comment": "Malware payload (Formbook)", "value": "4e951935ffb3b5b19e5c34e350d3ab292eb581e5f5197ecc377c6c40dd3e467fb8a378257fc31b0dee1faf2109210a55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168771, "uuid": "380caa60-d011-4ddb-ba2d-7856a285be6a", "value": "T1C5156C197C6989E2C224D677DBE7C12673635F567732C96925C233620E3F386A8CB10E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168771, "uuid": "455922c9-b386-4b32-a2a8-93bb91ea3795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168771, "uuid": "4333816c-a870-46b6-951d-029004fecec1", "value": "12288:VtutqbSe6z82uudNSi7GrRybssxWqdONCddfvOBkte24XYhdY575VkrmAseE:56j77GrRyFWCONa3OBkroSYJf8mAseE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168771, "uuid": "c14de82b-3879-4358-95db-f3e34b42f01b", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168771, "uuid": "5e65119c-741e-42b4-b704-b280f1a1bece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168771, "uuid": "df5b0136-5739-4307-907a-d9522e0bb615", "value": "RFQ-HMK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b14c1ec-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1680198305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198305, "uuid": "251b688b-b2dd-4e8d-969b-99314858a2ec", "comment": "Malware payload (STRRAT)", "value": "311ef1f6a6172d92cc3e25ef956da75b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198305, "uuid": "c921f3e2-c8bb-4c03-9f3d-89fa389c7be4", "comment": "Malware payload (STRRAT)", "value": "0df05fb645c21efe2ca3d955b82e24369238355bcd54f593ba8643b639a543af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198305, "uuid": "0172dbbb-399c-46ed-a100-16cb81c2642a", "comment": "Malware payload (STRRAT)", "value": "6dc2284e6668d462a3122e924b88fc1cdf28b07d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198305, "uuid": "629f8f7f-d175-4079-b84b-ac4990322d7c", "comment": "Malware payload (STRRAT)", "value": "3de60ca5aa71679cab411760727bbf64375140644cd87e58ed8ddfaefcb5dbd650d05fe024a5beb9cd87f59c1da7d490", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198305, "uuid": "b29cf49b-9552-4095-9036-9d4e603a629e", "value": "T1A924095795842BD6A928000583A63E33EF949EC77194877BD4713FBDAB31F06E82B6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198305, "uuid": "0dc733c6-dcdf-4cb4-850e-a367563a4f99", "value": "3072:GQyejZErck/3o6u5KyLpR7OaaEZERx4Rzt2OeMHuK3xM3pqBw/4wohXG0RFA:GQyTrC5K2pR7OaHZyxGXIy0k2uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198305, "uuid": "f1eee6fd-9cfa-4843-a567-4034854e156d", "value": 218551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198305, "uuid": "75c5c510-efcd-4ba0-99b1-bda59452ac7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198305, "uuid": "1d81c113-1ad1-4694-8e66-5e7da2c5f7c4", "value": "Payment proof.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4042e66d-ce96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680138023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138023, "uuid": "ba0e44df-a2a8-4ff1-bd7d-8cadadebb7a9", "comment": "Malware payload (Smoke Loader)", "value": "8aa4e7bce922a75716a64a0d35e3878e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138023, "uuid": "682e22f0-d3cd-4cef-9c4f-4ce00de73ef5", "comment": "Malware payload (Smoke Loader)", "value": "0e8ffb98323bed68c52746cb3e9b7810055c78e64ba95be3b034dba40072a0ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138023, "uuid": "dc8188d1-4989-4d27-828f-acac403ad6fa", "comment": "Malware payload (Smoke Loader)", "value": "2333ff8976f43f8a9c2a5efc3a9754dda4e5ec08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138023, "uuid": "a9285507-f2aa-4a12-85c4-1afd143fd1e7", "comment": "Malware payload (Smoke Loader)", "value": "2e36226f698b4c805ea44119d34eb2d388c2bc505c41b94522eaa7bd99deb024aad4e1d33b8d3f85cf5d5392d512b4e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138023, "uuid": "90dc8cc1-f389-4a05-9835-92bcb9b34384", "value": "T1B834D0227791C473D91B05754422CAF96ABF78704B568ACB3B840BBD4E317D28F36786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138023, "uuid": "2def8553-68c8-4c44-aaf1-c4ac984bacf6", "value": "248089891092684f7229c494995977e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138023, "uuid": "0e71c7aa-edbc-4b9a-b43f-79a5cd07b8a1", "value": "3072:FZXCZhvRLQR3EEcLQpXD7xccSYXrkDaOXbSiF0XNlm05fclj69/:bCHRLQtnXDNcEXr+XbUDgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680138023, "uuid": "125f71c6-5fa1-45a1-8366-4bf19e9d2965", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680138023, "uuid": "22d37c5a-3831-49b4-9463-49a0cefe44a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138023, "uuid": "292635fc-07ca-463c-ba9c-0f8504ffed3d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e705595e-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680185118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185118, "uuid": "d6aac58a-0dd1-4863-9464-be8d2da1160a", "comment": "Malware payload (AgentTesla)", "value": "89ab448998a91c5b800515522343a67b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185118, "uuid": "07ce9c23-023c-4e36-9c4e-d1dcba07903d", "comment": "Malware payload (AgentTesla)", "value": "0e98017a6018b750789e8b7f6f4a0ee880512d36496e503082799df228bfcc0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185118, "uuid": "fcfef3c4-ce82-4fe5-b931-d40a2a146c82", "comment": "Malware payload (AgentTesla)", "value": "1a6e87e4d9a0843da2fa15f840d33f7b4cbcd20a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185118, "uuid": "20c4b61d-ceea-4f56-9c3b-7785d079d318", "comment": "Malware payload (AgentTesla)", "value": "13669ddcb88ef0750faaa3776bc30ed5677a1e67a675dfa001b7c5e80d7ad6e4c4f57ba331dccf131b500f29d518223d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185118, "uuid": "a64f50b0-b182-47c3-be41-ce7a87452878", "value": "T162E4011435ED912BC565863A80E4C1B0677ECCC1E66ACB675FCABD8BB3CE30A543518B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185118, "uuid": "e144841b-214f-4a9d-8e5d-b9dc9d2f1e6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185118, "uuid": "2f6377c0-fc1b-4825-9720-bdcb1d8f8a3b", "value": "12288:leJ/sIt3ehOoLVRhXcVVTJmk95wLoRfHP37z6ANHHK9+QzLAyVFuddlENnSimOM9:9wGlMxQ45wLoBdNHq9+8LAyStQnSimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185118, "uuid": "8419cacb-c11a-484c-bf01-9019177b2f21", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185118, "uuid": "6cee1fb3-03d0-40eb-95b7-75a276b05913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185118, "uuid": "66af6ebe-d07e-49d1-86a0-b6375fb7ce2f", "value": "0e98017a6018b750789e8b7f6f4a0ee880512d36496e503082799df228bfcc0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff09217-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680200917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200917, "uuid": "e677be6a-4949-4753-9145-19caf8573da9", "comment": "Malware payload", "value": "9f7c280b20d021f0a0984d1ad0aeba41", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200917, "uuid": "f75937f4-3b21-41fe-b796-00823f00014e", "comment": "Malware payload", "value": "0ee32e3ea3d83da9df6317d7c8c539f0f3622af82ef242d74fdca1e5d4ee427f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200917, "uuid": "48a83fcd-43ba-482d-a1a9-de95e1a6cc85", "comment": "Malware payload", "value": "1ec6b3e3ba10c07468df40b4707a1d4b86490aed", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200917, "uuid": "0fad76be-3fe3-4f5c-adae-90fc1440233f", "comment": "Malware payload", "value": "3662dfb052e42dbe2524dc135740758c27382352f295a038bf9bf497bfba78994ee949d91411aab1813283419ea3b1b0", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200917, "uuid": "feeb929b-f0ca-4ab5-ab0d-a468ef07e8d1", "value": "T10A93D645BB81E913E05226708DE6C65833247C0ABD28CF4BB344BBDF3CB75A4B855987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200917, "uuid": "da782759-dc9f-47f1-a6fd-bc32eb6456be", "value": "1536:lAYFuIefZMGZyv6sjqDI3+EbaV6fYCazk:ltZehucEbaV6dazk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200917, "uuid": "a4410802-c434-4063-8cf3-017bcfc3aa71", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200917, "uuid": "fd9488f5-96b8-4590-b706-7d227d249b81", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200917, "uuid": "8641949d-d236-407c-beb4-43da3c550951", "value": "SecuriteInfo.com.VB.Heur.EmoooDldr.2.E4095826.Gen.24219.18440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74902d99-cf26-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680199958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199958, "uuid": "bf4becef-cd1b-46df-bbc2-c35fb1fe743f", "comment": "Malware payload (Loki)", "value": "990a71ba6deae9f8fd91ee813295b970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199958, "uuid": "abe29b40-6239-4df5-b448-6004ed9bd2cf", "comment": "Malware payload (Loki)", "value": "0f24fb2458d39329f2ab4e433fbcfa415667de0123004c023e923e7ef35de603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199958, "uuid": "ed89ec3b-d2b6-49f9-a772-5c0723cd9874", "comment": "Malware payload (Loki)", "value": "a1469f8814bd3dcc4ccfe890aadb45995ca32e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199958, "uuid": "75e4f52a-15c2-45eb-91a0-a3db77c9bfbf", "comment": "Malware payload (Loki)", "value": "b59c074ce6357a523f7afbc34713680cc21ed2f9f5f2cb32e3fc9113e96f828a58b99f5dabad44738679b115683c5ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199958, "uuid": "d418281b-87ad-492a-81f7-da39f8c8657e", "value": "T144D4F12836ECC919D02A977D80E5D2F053BACDA8E563C7130FC8BCD7B38E356656518A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199958, "uuid": "1ddb8d79-714e-4d40-96a1-c8bbcc55e82f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199958, "uuid": "fc160f8f-3d4d-41ad-ba19-38ecead16a41", "value": "12288:NGFyY6lYeY6dIqvcjnJ9MvE2ztQk8+Commh3imOMt+:N4yPlvcjJkJQk8simX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680199958, "uuid": "76ac9c71-1056-416b-b208-c3556798cd18", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680199958, "uuid": "44d66389-b55d-44e5-b9ca-bde7300989fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199958, "uuid": "f2a08b4f-0068-425c-bd24-558bdde6382e", "value": "990a71ba6deae9f8fd91ee813295b970.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9c67bc-ced6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680165421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165421, "uuid": "987f16fb-f131-479e-aac3-658948b52fbc", "comment": "Malware payload", "value": "c42fb96d2cba3c522afd6dcac2c749ae", "object_relation": "md5", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165421, "uuid": "c6412ea5-b85f-4ff1-ad3b-959486b4c987", "comment": "Malware payload", "value": "1155a4bda37531553661a61fcee361d664103ced30ace615406c6cd298a2c93d", "object_relation": "sha256", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165421, "uuid": "1e3d4939-4138-4214-bb58-e647c24c5fec", "comment": "Malware payload", "value": "26c76d2021d948ddb7b5c4b0b5a32be5d57bdc93", "object_relation": "sha1", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165421, "uuid": "d024ac54-a481-4408-bb15-1cdc28056556", "comment": "Malware payload", "value": "c0fa8209c6003e5696fc421bf666f16056539df2afd1c0eec53481c9802209e0469236a0e4c535beda7e586a96034502", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165421, "uuid": "a8f3c618-2c55-4058-b179-86b06aa9b2dc", "value": "T113E423F0CC7ACC74D8C300B66542BAF50246CED7FD8E5E5924B92B1E25BABC099A7057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165421, "uuid": "022122ee-c0ff-455c-92e1-0dc3927a9619", "value": "12288:nh8jlBszpImv+fuuieRwAlaQ8HQ7/gBMb+3VTK57+gcj6LtY5Q/x:nmDszO+GieRwC8HwgBMEVTnQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165421, "uuid": "464bbad1-c821-4fe5-970e-497bb665b0af", "value": 692048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165421, "uuid": "6479fca2-1e82-4bd0-83bc-c520e1696706", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165421, "uuid": "4fa77d2f-d3dd-4024-bf79-fa01113c3a4e", "value": "0323 Remittance.onepkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2083415d-cee9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680173618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173618, "uuid": "70c58125-4f87-4977-a6df-d34a9fdcc232", "comment": "Malware payload", "value": "82187ad3f0c6c225e2fba0c867280cc9", "object_relation": "md5", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173618, "uuid": "f3c8921b-c993-4ee3-9824-44c15f3df2f4", "comment": "Malware payload", "value": "11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03", "object_relation": "sha256", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173618, "uuid": "f29cefac-dd12-4c18-a549-bb9ac60a3ff9", "comment": "Malware payload", "value": "20d554a80d759c50d6537dd7097fed84dd258b3e", "object_relation": "sha1", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173618, "uuid": "e1736541-8cf5-43c2-8fb4-7f6eac49a5c1", "comment": "Malware payload", "value": "8d097e8f5bfb147b5ab9624247656598afbca3ed177182e2f0787415d67985c617fb6b9157243be814ee5fc22962cfe0", "object_relation": "sha3-384", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173618, "uuid": "0e24cbf2-2d96-43f5-b744-63916ffaf42d", "value": "T1A6368D5673E940A9C1BBD138CE479213EBB1780403345BEB5191C669EF73BE26A3E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173618, "uuid": "171ea454-bc5e-46db-9055-0d637d2aa793", "value": "dc71769f237c0a3ba38879380c54a4e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173618, "uuid": "b9b4748c-5c02-4f96-9eed-b79ac6c3147d", "value": "49152:uuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccb:Ky904wYbZCoOI85oyI/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680173618, "uuid": "97d8e196-251f-45f9-a88e-6b3c712a7fd8", "value": 5168344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680173618, "uuid": "330fd0d7-518c-4a03-885f-6b5c58aa3a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173618, "uuid": "46ed3206-52fb-408b-87be-def1943f8551", "value": "_d3dcompiler_47.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2824162f-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196824, "uuid": "759ed82e-af57-4634-a597-769264e6a894", "comment": "Malware payload (SnakeKeylogger)", "value": "ab238bc25c10af9636257ed7f4f62b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196824, "uuid": "0b525e49-80b0-4109-a65b-77a184bd844e", "comment": "Malware payload (SnakeKeylogger)", "value": "1266a1998f66541ff6fab4f9b5ee4b495cc1f1ade63104805d6aba75efec985f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196824, "uuid": "565650af-0c74-47d8-aba9-f6241d3ca04d", "comment": "Malware payload (SnakeKeylogger)", "value": "b7b81b88d77945f8c92e8d7b502f9132e6117a75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196824, "uuid": "9157e7d1-1134-4583-8067-6bf5d64f21be", "comment": "Malware payload (SnakeKeylogger)", "value": "a90c782b3bac9540f4c105e8c747973767fe37aebf254221f3aa3a226e26c65eb973547f0fb6bbe884579d4b01550abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196824, "uuid": "0cccbce9-c5c3-44b0-9552-393520ea2720", "value": "T12CD4014CB9F56433FDFA47B609E013444B326226B226DBEECC95E0C47DA3785A5B025B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196824, "uuid": "7206ffff-a8e7-45f1-9fcf-9a0f30e051d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196824, "uuid": "8d4203e3-754b-4cb0-96a5-842424dfa726", "value": "12288:g5AGUow20HmGR6lSyD38kVFJLI45t3ReRVQJnjJd9EQ/VEj:gyGyHmCy4tGP2KJjJfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196824, "uuid": "4a8ab7bd-10e5-4521-afdf-aaa0bb93e04f", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196824, "uuid": "4ef55fa8-3c10-401d-9b79-34912685911e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196824, "uuid": "ac482d72-f36b-47a2-9aaf-7c9b2fe67ca9", "value": "LdGz9By352orICu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1757aec4-ce94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137096, "uuid": "efe27fb3-5a44-4599-bd21-ccd69fd9f740", "comment": "Malware payload (Smoke Loader)", "value": "6a128e08500a89215411d0fba8ab6d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137096, "uuid": "5fed6a9a-7a9a-4f58-a88a-3b44619bb23d", "comment": "Malware payload (Smoke Loader)", "value": "14105349d52389c5f5421b2f382d6d9dd9dd5554708f7f6ac2d0d7b80f342b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137096, "uuid": "5c4a3e30-fa8e-41cc-b2e1-b5f0f0e3b15e", "comment": "Malware payload (Smoke Loader)", "value": "0924c25fa5f2c9a7968c3228f445eb5625e6b6fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137096, "uuid": "ff8f8ee5-47f4-49bc-ace6-e0b934626aba", "comment": "Malware payload (Smoke Loader)", "value": "67eb9bbc48ce58c228151ad41d61e0dd4aba1bed7790d9c3a3e3e43f7210bd7f2468bc45dcbff248455e006fa6aab8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137096, "uuid": "b045d118-af53-4adc-bf9b-df7eb8b10ba0", "value": "T18244D01277A2C5B2DC5B05794811EBB45A7BB8714F61CACB37921A7E4E303E28F36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137096, "uuid": "e43e68fc-1e04-4c3f-b9c3-fbf84673cafd", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137096, "uuid": "6c164443-b3be-4010-9277-f05b8638f8ff", "value": "3072:rlCK8tYhJ8XJdxMwLescZgHRtCF7XIjlBqXvmTF19wCOd4pSD/:rD8qoJdxpLesBHRt8uBimTNwC1SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137096, "uuid": "ac6fb8fc-1857-4617-94b2-c7c0986fab10", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137096, "uuid": "a21d16f2-8547-48d2-91d5-598c29c45481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137096, "uuid": "e0b502e9-899c-4871-984d-ec9d7e363ec7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b68717-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680185119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185119, "uuid": "b8ed55c3-3712-49ef-97ef-56fb8d92fa13", "comment": "Malware payload (AgentTesla)", "value": "8d02daa7c58763d4400b7f93b97ca5a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185119, "uuid": "ea61eef0-dd52-48f4-a4d4-11b9b36144bb", "comment": "Malware payload (AgentTesla)", "value": "14bbd07c46327a8c4aeb412454bca9b2b46f254f63f562012d2d45f02b812766", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185119, "uuid": "59fe628d-ee90-47e0-83ca-714f05c9bbfd", "comment": "Malware payload (AgentTesla)", "value": "53bf5bbb7546f51ae1c4dcede475253926c02469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185119, "uuid": "9a8fa4f2-2f45-4958-b3d5-d44c762d00f3", "comment": "Malware payload (AgentTesla)", "value": "0eddf2e5755e186b649d723c8626536d551cafd7c291323fa80dd92f46a88f522d6c7ced407286cc6628a69f395700e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185119, "uuid": "ef1ae96e-2090-4924-922a-c85bee4c9d9b", "value": "T131E401182AEDC20EC02A837D81E1D2B15778CD948623CB630FCDBD9BB3CF7966655196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185119, "uuid": "b38990f4-42e3-4b2c-8f49-af2abfa32c1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185119, "uuid": "31b93b9e-6b82-482d-b503-18293fc1f6fd", "value": "12288:J9YUyFQnN1CfJf68CtY4S9xadgqJ2kiQWTuJQi/tYimOMt+b:JOUy2ChC8Cq4SkQRSJQOtYimXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185119, "uuid": "97dab9e8-7c19-4e08-a11a-4c98d54672e5", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185119, "uuid": "c811144d-0384-40b0-ad47-8422aafbc900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185119, "uuid": "40579140-b998-49c8-9873-30c20dfbdeac", "value": "14bbd07c46327a8c4aeb412454bca9b2b46f254f63f562012d2d45f02b812766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a908641-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165072, "uuid": "db6df9f0-2190-4b6d-ab95-fa2312fd3168", "comment": "Malware payload (AgentTesla)", "value": "b8baee902c7bf7ac658052892324bc5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165072, "uuid": "7a77b57a-a79b-4069-b93d-027c4894ae3a", "comment": "Malware payload (AgentTesla)", "value": "15093c3037d3949fb360a3dc48d61991985b940fb9b67eaaaf1b5f229e695b66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165072, "uuid": "920c9560-1f2c-4f0e-b5b9-ecac33d5d11a", "comment": "Malware payload (AgentTesla)", "value": "11de7a33f124ce1639e4bed05161a2921b015708", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165072, "uuid": "deccb264-978b-48e9-a6aa-f02749f4dc3a", "comment": "Malware payload (AgentTesla)", "value": "744ec22922db7e40c14abc306d3f0e0bdc9f07805979dd931f7165b5f4e080461dd540fdef2fa907e2ada513b7669369", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165072, "uuid": "0b9cfc01-881e-49f1-86a2-e780c545c218", "value": "T146955A243DEA5019F173EFB69FE4B9D69A6FB7733B06A41D109003860B23A41DD9253E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165072, "uuid": "07aa113a-f789-4828-9f90-4f399b790192", "value": "24576:NopfWyN8o8lcdQTNCMRI2+aVi2rBZZof36nnjqKoe8:i/SBRRMEICjqKoe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165072, "uuid": "216da9e3-c53c-4cbd-a32d-0700745ff485", "value": 2011648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165072, "uuid": "ba7124c7-2092-47a0-85b8-4422436d2444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165072, "uuid": "7ed7174a-69ef-4d20-921a-8aa26897e141", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65496798-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680161278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161278, "uuid": "c7062e15-227f-45a7-8860-12a11447e48e", "comment": "Malware payload (WSHRAT)", "value": "faa1349089a33676434cc9deca10bf7d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161278, "uuid": "3e1c71c1-e0c3-42a9-abc7-078b9273b4c4", "comment": "Malware payload (WSHRAT)", "value": "159f8bf05cfb8aa77a15523e0f957dc5d596ec4268564a09e9adcce902b6036d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161278, "uuid": "61d15f36-ae8f-4a75-a364-dfdc2561e914", "comment": "Malware payload (WSHRAT)", "value": "ebf43f904829f0f81d734db58b1d2f5e393df22c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161278, "uuid": "b2d5bb2f-8988-4d17-a67f-45497e99a37f", "comment": "Malware payload (WSHRAT)", "value": "04b233f1d253b9fd6965d775994cc5bb357cbf820babe84927ec0b3615d61e8f109f59c0bdc5b86b0416347ea12f9a4f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161278, "uuid": "ef1db59a-c9c1-407d-835c-fb633240a186", "value": "T166252C8525B43A1DD7A3E620C711E622EC74F9231C9722D3BDC47A4EBEB5C4859BDB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161278, "uuid": "3e1e9fe9-c08f-441a-8003-04689f02947c", "value": "6144:2pkargZWNhPwMGdrez1TsuwzpZSSTuiIu8uzfOgw8Y5PW+KZZJ/26KWKMeihf/nm:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161278, "uuid": "cb9d0dc4-2df6-4ca0-8eff-d23b34ae6b76", "value": 1008321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161278, "uuid": "f1cec2e4-3cb5-4025-8c3d-48a50b2d0f7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161278, "uuid": "e7d8df67-0cd7-4f99-8dd0-0bd939e48a11", "value": "Scan0043.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86faa751-ced3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680164341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164341, "uuid": "1cf1eb01-7a6d-41b2-8aa2-81effc563c71", "comment": "Malware payload (Stealc)", "value": "cd96ff6474bc52219a3f93d35eb50dba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164341, "uuid": "702ab864-0eb4-42d3-a39d-4b802b8162c7", "comment": "Malware payload (Stealc)", "value": "15abda25306ba3ceeb816e87783ce6ed7d46248d068d2f5ac1e348d47de91633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164341, "uuid": "41c89220-03cf-4dfc-b462-15123970a529", "comment": "Malware payload (Stealc)", "value": "e2f7d54f28f34265148bb88100971facb58b1cb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164341, "uuid": "81d24dc0-79b2-4c04-a5e2-621d25c80c13", "comment": "Malware payload (Stealc)", "value": "0f55d920f5511b9c71108d9d0a56241131cabf81030f393dba0ac001565cf9475dbbc904623bf6cc63b299d65dc9cd9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164341, "uuid": "ac36df24-9039-48b8-8019-7c9c5ee2f0f0", "value": "T154345B069EFC7830E1234E368F2EC3F42A1EB4617E15BB5E164D5A6FC5B83A1D222715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164341, "uuid": "d51d1247-795f-428f-9a31-f0b36126870b", "value": "09829a76b54b4835c677dc6fac4ef621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164341, "uuid": "ae6685b8-f6a0-419b-aaf1-7f6b14bb8493", "value": "3072:op1FScu3Wq+WJzxzTwbacIVNpQfEuycBeQcchjfa/V6s0:o4J3WPizxxKxljf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680164341, "uuid": "a29242f7-4364-444a-8997-a7c4f4fdfa2e", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680164341, "uuid": "2588a888-9599-49c8-ae22-5a7974b5093f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164341, "uuid": "ce933bcd-7660-4698-b61e-344e51f831fe", "value": "cd96ff6474bc52219a3f93d35eb50dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369231ba-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680158623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158623, "uuid": "fb698d70-fe3b-4731-be9c-82d0a17aa96b", "comment": "Malware payload", "value": "b961980c1ffa928b21d080672e0cfc72", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158623, "uuid": "ae8cc410-963f-4f3b-b8d3-ef3d6ba29114", "comment": "Malware payload", "value": "15d2ef2e0905e5bca529006cb17d215c69c1516ba656c30c1ddb081dc885bf15", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158623, "uuid": "6678ce12-23fc-4e91-9327-a4e7cd901bfa", "comment": "Malware payload", "value": "115415db7cddc5d1051cf18c6189186a730b955c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158623, "uuid": "ce9b6aec-90df-48d1-83e0-b7a7a8eac8bb", "comment": "Malware payload", "value": "8342b21e6584d04231f84f7aab55d6fc77232eed253d3cd22445f55851274d2091eeb06fa4021b90320c3c1bd956e36a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158623, "uuid": "1b340570-fa2b-4a9e-8e66-9935cf55ecab", "value": "T11434CE533610CF47E454C3F57FC79D9A6B4AAF45AA8239EB20503B9F2F3014189DA62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158623, "uuid": "ddd17838-61dc-42d1-98ab-645e9e2fad13", "value": "6144:DWaFJkKXiDU7w5dW784kELJc1b/SmtARG89Y:yaFiKXKbEdch/SmG9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158623, "uuid": "f7084c84-44d6-49fa-9105-b3625641ba48", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158623, "uuid": "a1c1a336-a564-444d-beab-712cfe4c6e3f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158623, "uuid": "9a5ecc3d-d372-4e54-a79a-55eeabe17075", "value": "PO # IF23029361209.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33f673a-cf11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680191125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191125, "uuid": "ee9d7c43-2c77-4ece-b2a4-cb22e47ef445", "comment": "Malware payload (Amadey)", "value": "588844ecfe8862d589d43e157cb39991", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191125, "uuid": "5de84dd3-938b-46c5-a53a-08a4f380eb72", "comment": "Malware payload (Amadey)", "value": "16a6de613510a318f7176f695987777a21ed290d68709a8652d8ec33f62acea5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191125, "uuid": "72d49e0d-b56a-4ffb-8178-c9ccb1165fc5", "comment": "Malware payload (Amadey)", "value": "1e5de6b2422676295de6ac1c443852ea90bc5c49", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191125, "uuid": "3bd25e54-9f3d-452b-85d4-1a9f91d40e6e", "comment": "Malware payload (Amadey)", "value": "a6305002acfc6838966cf6da9c660b4f25add01146fa00b94dd7486b80ba36101be83bd4b00c39014c7a915aa4003938", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191125, "uuid": "f6c167a7-ee43-4feb-9e88-c51d1baaad6f", "value": "T1DE252315EBED8037D8B657305EF403931A36BDD1AE30436F12A169B91CB2A84B472B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191125, "uuid": "5d353ca5-0fcf-41ab-83ea-c95b8e3fdee1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191125, "uuid": "16c90d05-2d7c-4b8e-a2d7-e3127e7fd90b", "value": "24576:zyjhOsKSywNnXzMEOFwME8OisqPA+lSaXpEUVl:GEDyXQEGw4iqPfjpjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680191125, "uuid": "ddb85adc-565f-486a-9b09-801372c851a0", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680191125, "uuid": "4f6721c6-0c71-41d5-a728-4c2f58e47c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191125, "uuid": "552d67f2-af7c-4e36-8610-fa199064bb0f", "value": "588844ecfe8862d589d43e157cb39991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3739b81-cedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680168738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168738, "uuid": "a27bc2da-46cd-4eb3-8882-eeaaaf224e64", "comment": "Malware payload (AgentTesla)", "value": "7dfae8d21b887ed5d32e2ff010034bc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168738, "uuid": "c52fd598-4056-456e-88b5-035cd0cbaf0d", "comment": "Malware payload (AgentTesla)", "value": "1723dec74416c2918e74abaa994d03af972fcb40ae8c6c0579fe29be92836b8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168738, "uuid": "ec36f6af-2606-43aa-96c4-8bc603af2bce", "comment": "Malware payload (AgentTesla)", "value": "93ffcfdf05e9b957aa7d1f36a213592383faf395", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168738, "uuid": "a2c73731-fccf-4486-88ab-bc4ae73c8e12", "comment": "Malware payload (AgentTesla)", "value": "dcafe547607ca2cc7eac0d86deee553193ed20ab6be22142d327d9b794218f50497adc8bc27a64dd6a62ba193fa6fd3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168738, "uuid": "c5c1e3b8-0cfc-4936-934f-427dfd7b3650", "value": "T1E9226B3CDA11FC16C121047DD14982F1FB2C01A7EA52BA2D2196B29D47606C7CBDEEEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168738, "uuid": "b112fb5f-8aed-4965-af02-8ada49c12189", "value": "192:ScIMmtP1aIG/bslPL++uOzl+CVWBXJC0c3Ce:SPXU/slT+LOzHkZC9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168738, "uuid": "a914c47f-1b80-4c3d-8744-59ffd9c9fb91", "value": 10404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168738, "uuid": "50280518-ded2-4f2d-8cb6-85cd0da1310a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168738, "uuid": "bfa833ee-4565-4708-8bf5-616b04ead612", "value": "Swift Copy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b3d2a7-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161245, "uuid": "e7e4981b-8641-4afc-af2a-0af5428e7dcb", "comment": "Malware payload (AgentTesla)", "value": "934bd53497aec99627a9b6c48cc966bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161245, "uuid": "9c2db862-df86-413a-a762-512a75ec3b20", "comment": "Malware payload (AgentTesla)", "value": "17d02a46d36d276311b26963af8c73b27838fe026b32dcef9021a96c85a5a9c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161245, "uuid": "17b804e7-bfdd-4a44-b5ae-eae9dc016798", "comment": "Malware payload (AgentTesla)", "value": "25a4d76f441e1d9e3eed218f5a1830d164b95d3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161245, "uuid": "69ea403c-821d-434a-ad53-e57fcc2aa8a5", "comment": "Malware payload (AgentTesla)", "value": "502ab27331ab6eafce1359112962b37b94ee74ddb293e862e89810fba4017a075ffbc3f9bff41a924ea16149ad177581", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161245, "uuid": "90e8afce-4b45-4721-8e1b-08ddb9252887", "value": "T125056A38E25C44B3EE5923FC1A5ACC79A2E95C279A208F595BCEBCC7767C6456C83043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161245, "uuid": "8cd47fb9-619e-4e50-a96f-37d8a0ba93ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161245, "uuid": "13382167-195d-443d-9a1e-a426c10a3699", "value": "24576:B7iVsTwW+pMpeNcFbHN5cBVMyXjimXvL:B7iVs7kD4bHNiXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161245, "uuid": "fa7b80e1-7f74-4047-8068-2dcfed8b8070", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161245, "uuid": "d991cd59-6421-49d3-8dcd-cc959485f63e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161245, "uuid": "ec622af6-1bd1-402a-bdd2-e35d688936c2", "value": "Garanti Bbva Havale tavsiyesi 30032023 TL8985500800058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfeb888-cedf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680169396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169396, "uuid": "1eeea8a3-46ad-4193-9b4f-2e006e24e618", "comment": "Malware payload (RedLineStealer)", "value": "fca86c7c3531f3dffd1695bc5c08ae74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169396, "uuid": "a041099d-ab60-48e4-8778-500704e31713", "comment": "Malware payload (RedLineStealer)", "value": "17de4a202bfc6ef9e6805362dbb99998276f6f992373e40d0c899a24e0ad4464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169396, "uuid": "84df7038-5357-4591-ada4-e39335d5f026", "comment": "Malware payload (RedLineStealer)", "value": "c818e66e61f57020b255ed219e804e57d256e996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169396, "uuid": "da6fb3e8-af73-4420-af09-095fa89a7174", "comment": "Malware payload (RedLineStealer)", "value": "1b8c35a431b6278f825b118098c08d7fd8e38101c0d832f6a5616a3f230c4ceb66f8b65a154eaec4350ccf9ceee6a0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169396, "uuid": "ce0b9b91-4ea9-4592-bb93-f2467276904a", "value": "T18955D345B75C48EDE0AF9AF131A15B6AD01A6D2207DC5B5ABEA4EF3CFE12344C1DA04C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169396, "uuid": "95212bd9-dfa7-49dc-baf9-810cabf4e56f", "value": "e73730958ca31b58b1bef13f45cdbafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169396, "uuid": "b536ddfd-9e98-4cd8-a345-c3214049dfc3", "value": "6144:FRjI7VrutXxNlfkPLAO06KqscRC3mn4MCzxL+99:TjI7Vr5ZtXl4MCzlo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169396, "uuid": "dc9a121e-b9d9-4c9d-b77f-4d335948563d", "value": 1281024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169396, "uuid": "626ffb86-2b9a-490c-845c-c05460730dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169396, "uuid": "9574226c-9f8b-42a9-b0b3-9e123c1c5960", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3130e3-cf32-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680205238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680205238, "uuid": "c655d2d4-08fd-4acf-adae-3e7f4b7ee208", "comment": "Malware payload (RedLineStealer)", "value": "0e4b5e87174982df22b52a8cb1e869e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680205238, "uuid": "881a4f97-9230-4cfe-8929-c57310c42516", "comment": "Malware payload (RedLineStealer)", "value": "17eb36792d35102f79556be7334b5c6d72538c41f2b22485fa290a929d751c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680205238, "uuid": "f194f613-b1a5-4750-8672-966766d6795b", "comment": "Malware payload (RedLineStealer)", "value": "be82cc93f21d815edf930f0a77917501f0c46912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680205238, "uuid": "d2aa24a7-7a59-43c2-8828-1b5a144d9acf", "comment": "Malware payload (RedLineStealer)", "value": "b2775b9a3ecdca434b9e4b1743c5ec03479fefe5d84ee205f9c3c3085904843d97dd4dc5f3929e16cc8fccbc20f29c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680205238, "uuid": "c2b002c5-2386-451d-99f7-fd1e1fd90d18", "value": "T1E344D9EE7FBA45DAF268053397DCCC6443626CB3A8D4B2071988B6C90A31ACD41BFD55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680205238, "uuid": "57a73449-bae8-4b81-a747-c1829f76e751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680205238, "uuid": "a9d14061-55e6-48a5-ba32-9c3b606ff7d7", "value": "3072:MnWztSKOM6O39aLc/z/SBPToDR/rDc1kAr0:MnWztSAtZykA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680205238, "uuid": "58a51810-db30-457d-b586-faaa67d8d445", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680205238, "uuid": "6899fa32-c1a4-41d1-a9de-da06d872b185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680205238, "uuid": "f1c585d7-45b5-4299-a324-bd675d3f524b", "value": "0e4b5e87174982df22b52a8cb1e869e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe51f41-cefe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680182932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182932, "uuid": "7b9f47af-4fe3-4786-bc69-d46d6cb848d9", "comment": "Malware payload (RecordBreaker)", "value": "ebcc280f50fa2595d47df988963bc9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182932, "uuid": "68867619-facb-49a9-804a-431f8eb4a11f", "comment": "Malware payload (RecordBreaker)", "value": "184e98107496e5859dd0f09c42deffffaf0cc9362cc192f0e89bf2c4b20d82fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182932, "uuid": "a827d4a4-e4f9-4b0c-a2e8-0b59ddfca052", "comment": "Malware payload (RecordBreaker)", "value": "e4fe3aeabdad15c607d32763c91b3b3b5d2175d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182932, "uuid": "1a202179-3429-40f0-8ed3-e63dff1c1ff7", "comment": "Malware payload (RecordBreaker)", "value": "8e899e26a861cdbaf3d0224692c2b0c0ee5a0ee2017be074090aac1c39869e7ac817ee71162c3c073efd19abad5882ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182932, "uuid": "c4729cf3-f6b5-4453-99e3-3d6bd56fc673", "value": "T1CFB3C90D96D2B81AC354A8759243E8736B164D7CBCE95DDEADCB8E3221F64502CACFC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182932, "uuid": "6ddfe098-003c-4052-9f2c-1b9f3d968272", "value": "97d41417e1c898a9dc85fb4d98655fda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182932, "uuid": "e4c4f965-39f7-42ac-a9ed-803391a084bc", "value": "1536:/ja4qX8uFJQvccqJ4QFn8XwcWwH7Yq8BG8TcdayFtvhV732+oOl8s4PBqZ1zObEg:/jYPQRQmr8YLNL6dzjPAvZjy5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680182932, "uuid": "b912fa7e-3a12-4d08-a006-460390cd6902", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680182932, "uuid": "45261f54-e52d-44ad-a416-eb0b3f990e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182932, "uuid": "fe19b868-dade-4f64-8690-73d64cb2a26a", "value": "gpolci.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f56c52-ced9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680166921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166921, "uuid": "4c575874-58fa-4664-809f-91eaf48dc036", "comment": "Malware payload (Formbook)", "value": "fc032573da788f89db0ae03dd7ed5bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166921, "uuid": "424c9ac0-832d-4130-b180-2f0117fa3bb5", "comment": "Malware payload (Formbook)", "value": "1880da4893c270cb55e2e7f0c7e1adfdee2d90ebd09b6cf7d67303c3a466f44b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166921, "uuid": "eae1b32f-99c3-4294-835a-14d53970b8ae", "comment": "Malware payload (Formbook)", "value": "ae0919029fbf907ea7453466ded115d9771422cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166921, "uuid": "04e8479a-2e40-4368-aca7-b10e4a8e268b", "comment": "Malware payload (Formbook)", "value": "4ff4f849f059b6f55bc37083d90a8cb6214fac53010780489650235a4e2f55388b359dee6d99ec926a2ce10c1e199676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166921, "uuid": "80197bca-116c-42af-9d1d-e94994c7f69b", "value": "T17F255B41EFAA2560F01044B9216B7D5FCD51A88D99EDFB6E190FEF31F5E221D1C82E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166921, "uuid": "ae9927a3-5308-4f37-97e4-dece45bff73d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166921, "uuid": "45f9f327-387e-43d2-862f-d9e54d6e9964", "value": "24576:dQUqL3KnHBxvRNIx3NiZZQ4sqaCFNjPsN:23IH/vRs9yfRZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166921, "uuid": "3b1d7a28-21bb-4ee0-afd8-0a7c4e4a4dad", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166921, "uuid": "f74976dd-0faa-4a81-9826-77ce6c125477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166921, "uuid": "859a8bdf-1c82-4639-a288-15643ec5eedd", "value": "68UGldLKTo7An5L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44b4841-cece-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680162297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162297, "uuid": "da5e4b29-838b-46fd-8ad3-11dcf3bbda19", "comment": "Malware payload (AgentTesla)", "value": "bc1fac98c09af837959226f91f6d54c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162297, "uuid": "40438fb5-13ab-4423-bd4f-120ad003a0c1", "comment": "Malware payload (AgentTesla)", "value": "1897da9314bfab3a6feaae55d4e82fa4f764c04593c9aedfc4fde0f7e7f7a2dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162297, "uuid": "795ef6de-33a5-4642-b5ee-8c6deb02e4db", "comment": "Malware payload (AgentTesla)", "value": "5257b8498fb0df2e06259fa49a6b333f34603944", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162297, "uuid": "d4d82f41-5eab-481e-9670-8d097c4d02fc", "comment": "Malware payload (AgentTesla)", "value": "9b4a59ed9916fc4adee71b31ee3c3bde3586ba187f837a2ccba5fcae8c31985833b290aa3ee882b3075d84c4b2034a4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162297, "uuid": "7b74c6d2-fdfe-4b39-af34-58b53b7f2674", "value": "T1BB051245D7906120EB7987BC18A14D98C7BDA0E7A756EB0EEE0C64D31CF93D0091BA9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162297, "uuid": "cc9a4ac2-a68b-455f-a729-c10707cd7e30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162297, "uuid": "6753ebd1-853e-4142-99cc-4833465ba2d2", "value": "24576:jCVZ9BW+n+6AbaGZwMhK5Uu399i/Ml7R5:G3EK+fbbZveUuNP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162297, "uuid": "abb0df35-37cb-4dc0-be50-5cee8bf8ddc5", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162297, "uuid": "6532ab3b-c2ee-4880-987d-95d4079af9a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162297, "uuid": "f76a0766-6d40-4041-8254-aee60c2d6b01", "value": "RFQ 071.23 020.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2889079d-cee9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680173632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173632, "uuid": "7999371f-29e9-413e-9483-288053802d50", "comment": "Malware payload (AgentTesla)", "value": "131fc2043b4c740cb1a3bd4a8398a780", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173632, "uuid": "50618f97-167a-44ed-8890-b2cd552e348c", "comment": "Malware payload (AgentTesla)", "value": "191529d733524665838e0d27b44844ca0a3c914d8577d4f2d8c8b93ea4a7729a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173632, "uuid": "6c07b399-f2f5-4fed-ae51-f03a1a3b7c05", "comment": "Malware payload (AgentTesla)", "value": "041be9bfdbed62d56906f5fe2ebdad0f1f7037d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173632, "uuid": "84ef6b2d-f00a-4cb3-934d-a8746bd1d68f", "comment": "Malware payload (AgentTesla)", "value": "1a88710b16ce9d1a45e58dcb46275fa94bc225de4bf580605f49ec9a7953f95ab6aa80515ceead4512bd76065c489287", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173632, "uuid": "b1a7d240-45f3-4dd7-b066-36b1ff48a4ce", "value": "T1F6E4F1043BCC861AD02A8779D0E5D1F0A3BACCC4E562C7174FD9FC97B39E34A9962196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173632, "uuid": "8ce0ee29-9413-4a73-99de-0574231ca3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173632, "uuid": "3c3ccfcd-cad8-420a-8115-ec8249cac74f", "value": "12288:74DM4ky4LFhqvVeACFUYvHoIlC/BEzOCHHwaMgUa3EKrgXcsznauIimOMt+k:7Zy4LFyefHNlw+zOCnwapHrcPnbIimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680173632, "uuid": "12919171-3533-43a5-93a9-9a0ed67c5549", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680173632, "uuid": "0bac8288-fbbb-40cc-be50-280b5268670c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173632, "uuid": "f1b67f89-ba9d-4be8-badd-88a9f6ea597d", "value": "5190672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302fc46e-ce95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137567, "uuid": "cab417f6-4ffe-4786-b573-6ad5049822fe", "comment": "Malware payload (Smoke Loader)", "value": "0f7adc41c556fb6d0d7156be5e1f055a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137567, "uuid": "def10f67-acae-43f5-91db-ee3067c2e4f1", "comment": "Malware payload (Smoke Loader)", "value": "19b5ead96c8443fa6850c70338ed28288ca2dec2a0ec34d5bab352f904f42408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137567, "uuid": "f879c3d5-4d01-47b1-a57a-c61326e44dc6", "comment": "Malware payload (Smoke Loader)", "value": "5a76818e953aff4393b5cb783a4db02cb814baf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137567, "uuid": "bed4ab15-af8c-4735-ad99-6b704d3456d3", "comment": "Malware payload (Smoke Loader)", "value": "f71abb3076f5665e55ea73aa0dc0d70dfed3e10ee5a993e293925467be78428e6f23a6debc87afc6208dd487de44cd9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137567, "uuid": "69b4d94e-03fc-4149-b890-2d986dbfda37", "value": "T18544CF1237A1C872E81F067E4811D7B44A3BB8709B158ADF67945ABE4E317D28F3634E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137567, "uuid": "64c512d1-d228-4097-a1f6-d501eb6abffd", "value": "2d2bfb9c54ad9b595d71acc7d26596e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137567, "uuid": "94413c11-fa29-4888-bf37-3511398ec7b2", "value": "3072:P3h0Rap5XY8XAfunQL9iUld9j5AiQW7Z6CzylxDr6v5KtX0QmFR3t48+Dh:CRaj7AfuQL9PHnV16COKv54mFR9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137567, "uuid": "5f9520d8-5dad-47e5-8c76-9f1f9a0ac1dc", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137567, "uuid": "46e230e6-dece-49e2-b51e-906e5b959153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137567, "uuid": "b96ec3ba-6dd9-459c-88c9-75675c3b2862", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ca7c96-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680161866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161866, "uuid": "73abdf44-4790-40de-bfb8-dea5114f59e1", "comment": "Malware payload (SnakeKeylogger)", "value": "9dc3162ee9d9473e7d253c63e5e04acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161866, "uuid": "bd19d681-5b8b-47a4-b5d7-e8b96aaeb610", "comment": "Malware payload (SnakeKeylogger)", "value": "19bc779bdb31a070d3b122e2c58547649586b5481655a52db8b3ccadd958bed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161866, "uuid": "5f65c134-1219-48b6-b2ff-230f68a2bcfe", "comment": "Malware payload (SnakeKeylogger)", "value": "d25ccbc3d5530c506fd4a395e8e29a5186f52a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161866, "uuid": "73c0024e-8854-40b0-907e-7fab1f0abf85", "comment": "Malware payload (SnakeKeylogger)", "value": "2769687e41bce88208069a631bd3a43946bcf7f669f68d6f66e44d77004cd76301522587c4de02df16bca3ff1a6f258f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161866, "uuid": "57ff2cf2-ef0f-494f-b5f1-ae52df4ee045", "value": "T1B1D4F7F9B264C1AAE3BB46F16D2B686420F7ACAD98D0421D26BDB71C09B171111DFD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161866, "uuid": "baba27c7-9594-4453-8c73-df924ba1ce66", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161866, "uuid": "384600b5-2295-4d3f-9f37-8ba274e22c95", "value": "6144:sMm4CCHM4NL26fgvXDgkgcHHIA9kk+fQ5YhCwJQgARZ91F3hwIgWVTa:sMwg/NL26fgvXhHxUH7JTARZ9/RwIgsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161866, "uuid": "d27df279-86d4-47c3-acd9-b7ef0331e258", "value": 637983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161866, "uuid": "b2c9836e-8e93-4fce-bf2a-8431df0495d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161866, "uuid": "d9722d83-c9dd-48e3-a36f-6c46148f42fb", "value": "Operaciones de Cuenta.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d382ae-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680200818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200818, "uuid": "08846c49-fca9-4b10-8926-7199412e35d8", "comment": "Malware payload (Formbook)", "value": "441aa97af8ab929af47af76962584b02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200818, "uuid": "32c0b817-8098-471e-8054-c0cc8be88a10", "comment": "Malware payload (Formbook)", "value": "1c4a23543bd6562ebedfbc5905ff87a87d06d25a03b1015043314e00befa54dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200818, "uuid": "455bc564-8a55-40ec-bff5-9eac5483067e", "comment": "Malware payload (Formbook)", "value": "19179b5b35112d35d1b3514f1026663efb86ef37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200818, "uuid": "22ff2877-9c17-4d7b-a30b-c002c593f59b", "comment": "Malware payload (Formbook)", "value": "485a32ba44e5b22254408a6891635d7c432fb4046986c6a645755689c42ed2ab25684cc54fe31e216a9de1983179c789", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200818, "uuid": "2d45577c-952a-496c-8190-4dbea1268c32", "value": "T1C4F48D3C1BFC8556E039D7758BB04C20E7EDB5177636CE1E79EA01890A27A42768336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200818, "uuid": "7aeb0f28-0420-4d11-9374-71c1d95549a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200818, "uuid": "fcee67f6-ce3a-41f7-81b4-31d5b9fda606", "value": "12288:TkB9yywVrLzwY3TQ4PDUUoUqSYvCeRz42p/7:TYwVL3TQ4lXq472h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200818, "uuid": "93f6de38-f9ad-48d2-bf03-6cf5457f995d", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200818, "uuid": "12c1cbe9-ce7d-4b0c-8c4a-d6fa254fc31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200818, "uuid": "6958e2fc-e3c6-4985-9d2c-bd082a90cbe3", "value": "441aa97af8ab929af47af76962584b02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fedd0f-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680219213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219213, "uuid": "14ac9c99-87a2-4571-aadf-226c9ef4683d", "comment": "Malware payload", "value": "6999a900a4d656f108c5c1fbc65f8995", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219213, "uuid": "229f3938-4e54-419c-9c77-5287d8ced44e", "comment": "Malware payload", "value": "1cb775ffb7c4126d2564638e25644e55100c3ea588b59073a72ea3322c6eb3b1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219213, "uuid": "58b00ec6-6c0c-44fa-8b59-962987023f6c", "comment": "Malware payload", "value": "087fe7a4a0cde6e20478ab6f4412b32cb3eaca96", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219213, "uuid": "fe29ed7b-be1b-4240-9ab4-a5d16f64f72c", "comment": "Malware payload", "value": "810169eeeaaddc7c78f390429035c06f1417d099536ec6c13609aef75fab84050e048ea846eece3aa074098197aa4642", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219213, "uuid": "40ce60d6-ec6c-4cbe-bf60-ac7779e0368b", "value": "T1D8043041EE7B8DE2D129813418D2624A3BF5EE485D31270332EC757D2BF2C957B29AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219213, "uuid": "18c1ef73-21cb-483c-80a0-9ee7a8cfaa0d", "value": "3072:wq6myI5sdjDxZ3ecviPGzjEXbmqQicJAw6n1D8aiwRy2D4fBmdi:MmZ5Kb3naPFLZZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219213, "uuid": "b227f895-3b59-47e7-9083-484c1105dcc6", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219213, "uuid": "c9001ede-2bf2-4aa4-9304-529c652b9ad3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219213, "uuid": "db07de24-75f9-4922-90f6-3f77df86d173", "value": "SecuriteInfo.com.Heur.23016.20191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dedb559-cefe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680182633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182633, "uuid": "71bfd6bc-2504-48fd-8e90-ed2e91f1fd6f", "comment": "Malware payload (AgentTesla)", "value": "d160c471d9f3f14e2516fce839f4d644", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182633, "uuid": "4a192e4f-95ec-4d7f-9a98-933890ce43f0", "comment": "Malware payload (AgentTesla)", "value": "1d0a3d165801a8cc1afce2a96c47e613927f5e1e2dbb11ed4e896f8bb31a3322", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182633, "uuid": "c88d87b8-ba38-4c3c-a985-5e340f7039f2", "comment": "Malware payload (AgentTesla)", "value": "59a97c4a298027af647cf2a7738030da6fc062d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182633, "uuid": "abe9d1a4-0b51-40f0-84c4-eb2349f82de5", "comment": "Malware payload (AgentTesla)", "value": "9616e955cf843ba1df512f6fecf5a8effcef51f489310c952089dcf8cf8e236566bad62b4a1f84f57592ca360499aff4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182633, "uuid": "edabfb6f-61e5-46aa-bbb7-0b7b59875b04", "value": "T1B1E3925933D905EAE17DFAB0AE72326004357C2919E3EE0D1C09399C4EF4B865573BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182633, "uuid": "bbd7b2f7-6ecd-407e-9b5f-44e8b34d83ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182633, "uuid": "bf8fa016-68fc-42a5-bd72-c77184a784ce", "value": "1536:ib/cbvy5+BHJ9AJWtKUCoogCgG5cDf3Wi10GdJDbeQl7P:/bvyoJ9SIjGu73WK0GTDfl7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680182633, "uuid": "d4eba05c-b3ca-4966-a4bc-7aa185be0a33", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680182633, "uuid": "ae037c8e-6c44-4def-9d85-9b640e3a0e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182633, "uuid": "a32e10c2-4d14-4f88-99b7-9d8ecb25eb9c", "value": "DATASHEET PR-NO40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb098a06-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680158496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158496, "uuid": "e0035488-b8b7-4833-be89-e650ba4d5a65", "comment": "Malware payload (zgRAT)", "value": "2dd1596f1e5b787aaababc3751708dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158496, "uuid": "5d756909-5347-444b-9b8e-73dc83496d19", "comment": "Malware payload (zgRAT)", "value": "1f2a655fcde1d05e5005056fac1719a695fefc0529c24831cd5c9fdd1ac3dde8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158496, "uuid": "5f07a5e5-c58e-49c4-8959-7e66edb037c1", "comment": "Malware payload (zgRAT)", "value": "678846371b34b7fdf4981df90c3fff70bf785044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158496, "uuid": "5b01487d-1e6e-400b-95e2-a199e422504a", "comment": "Malware payload (zgRAT)", "value": "3bea39694c196267914a33f88189ef6172412f080018f192cda2944dee96a75163d95908889502ea777baa90b485fc0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158496, "uuid": "c110ebde-7466-41c5-8a8c-6557113e2546", "value": "T14EE3F71BEA5FCAA1C27C17FAC1F68C1007B0DB52F653EA1B769A22C61A037D7480575B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158496, "uuid": "10355d2c-c089-4a3a-a33b-ed368f363bde", "value": "1536:BhJERrJlro4AQCpodJdxQZejQQccHjPIkSPw6QvjTly0l2Km/bKpLlrtvSsgkU+b:BhQAtWwAjTly07m/upLVtT6Adgzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158496, "uuid": "9b6e53a3-c56f-4a0e-b335-1b6ac2620c82", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158496, "uuid": "b1a6a3e2-24ae-4d2a-b376-9248e0aba37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158496, "uuid": "35e69293-0afa-4fd8-8671-bedfd719e2d2", "value": "2dd1596f1e5b787aaababc3751708dd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff50f63f-ced7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680166261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166261, "uuid": "0423dbd8-2f54-4073-bbe5-2eddbb48b2b6", "comment": "Malware payload (SnakeKeylogger)", "value": "4514dcb70d881c09d3095cd16af7d931", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166261, "uuid": "d29d6193-1190-4967-b41e-e921290299b6", "comment": "Malware payload (SnakeKeylogger)", "value": "209ea03c770947b5ad193df961c86970d2e4eedee062f5df9ab76ecbecf4e987", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166261, "uuid": "85ad48c0-06da-402c-8421-06ae1eccf775", "comment": "Malware payload (SnakeKeylogger)", "value": "7204487889359759aa7840cf94e51ccb5e7b3d4a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166261, "uuid": "f97069ee-fdcb-4e38-b327-f96aea82d51e", "comment": "Malware payload (SnakeKeylogger)", "value": "523a37cbc03ff260898893e5df5508ce1ec5d9c062c9e4ff5c2b576c266bbce42a360bcf5490116594d78743eb4065eb", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166261, "uuid": "f0175d02-4ed1-45a2-a174-3bee8eac5af7", "value": "T1AF842357CE4019CE72C9DEDB288330DBD9AE165FCAEE973F1A01A66A00700D9CE6D51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166261, "uuid": "61063e15-7598-4540-9023-3217a1364cca", "value": "12288:MI+uPTIzxIu0jY0S95ha/hgS3LNZHmxuqwfdX:MuPTIL3D95hIPDBf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166261, "uuid": "6839f6bf-faa0-47a4-9b55-a9aa48e8fcc5", "value": 405314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166261, "uuid": "afb887f3-ba1e-456c-badc-f2ab791b43b7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166261, "uuid": "44fbc367-bcd1-4b12-8593-12ec710775f5", "value": "Pending invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a888afb-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180695, "uuid": "341f939d-30ab-418e-9116-1c3eddb904ee", "comment": "Malware payload (AgentTesla)", "value": "849c169c3d155741b67917f0d2fc1b42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180695, "uuid": "2fff0476-73fe-456d-9b15-17f9d810ccef", "comment": "Malware payload (AgentTesla)", "value": "2214417ca9bcffaa0455831c963b576cbb072efb7ad6dca11068ebe69444cdcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180695, "uuid": "2297d7ff-268a-407d-88e0-b4992fd15f91", "comment": "Malware payload (AgentTesla)", "value": "65564cc1e52e5ea21a58c2d58f783917194ffce6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180695, "uuid": "e81fea5d-7def-43bd-9187-c894b1a7ce62", "comment": "Malware payload (AgentTesla)", "value": "267f1305eb295607769860a01a29dd09f0402bc4716c9bde3204a02c561baab991891a263b8cab51028ac8c5da4a4319", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180695, "uuid": "1647a829-8942-4e75-ab74-e68ffbb6276c", "value": "T18694120932A0F86BD71606326E3ECFEBAE72DC1258E15F7637533B5D2A344514A0BB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180695, "uuid": "0fb98344-0fcb-4d7c-b8eb-7e7dc314a965", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180695, "uuid": "ef46feda-4f6e-4d61-9429-77902edc4326", "value": "6144:mT4DtVDc8/gxCuWcoa4fuY9nNk7Us/MwIUvsu/w04rpsXesv/apx/c6v3suc9S+c:mTuStPuNkb/jVV4r+XlvS7x/suc0Gs5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180695, "uuid": "4c645741-d800-4a5c-897c-fc770f9c345e", "value": 436082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180695, "uuid": "b0199a46-1c98-4d84-b85d-7c80ea1b789d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180695, "uuid": "9744e305-b578-435c-a06f-e8b5b01c87e4", "value": "RFQ U75553389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d393bcf6-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680158886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158886, "uuid": "101662e2-2f21-4aaa-b1bd-c4397d3aeaba", "comment": "Malware payload (AgentTesla)", "value": "a952466349a0c331ab90d89f42fb1627", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158886, "uuid": "ca46d71b-98c8-4a98-9fb2-f81650caba08", "comment": "Malware payload (AgentTesla)", "value": "2228c370877c1f0833d22362bb3db6fb778b7f005de41eb7d660e1043ecc6a0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158886, "uuid": "32e33ccd-5daf-4f54-9101-46c74a6921fb", "comment": "Malware payload (AgentTesla)", "value": "d1913e6fdf478a71558d4a29dfcdb19f1b307367", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158886, "uuid": "143e6802-8fc2-460e-85f7-43c2422ff658", "comment": "Malware payload (AgentTesla)", "value": "9f29b4a2fd9dd78736f27765399b70f32f6b9b108a640e3d9da0a27a2938e42948c5e0a22728cd1ea6c7e5566fed43af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158886, "uuid": "5ed28357-96bf-414e-a39d-6c43c8d2220c", "value": "T199150258D6DD5AD1DD6A0BB9583568600337BD297631FA2D1DAAB0A61BB33D30032F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158886, "uuid": "c040e54f-e78c-4d0b-9762-4fc5b591e312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158886, "uuid": "538c3d3e-16fb-4cb2-8e64-5c3a9c3640bd", "value": "24576:xVawxO5dSR9XTD7xJcSwMRDZGPavifM99Z:vTsaVTZJckDskX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158886, "uuid": "268ce205-41a1-4693-adda-aef425830757", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158886, "uuid": "94b9fad0-0254-4369-bd0f-250381d30357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158886, "uuid": "b6eb91ec-a7c9-47c7-a2b9-7321d7ef5c86", "value": "QUOTATION ORDER OF RAW MATERIA6778788889999.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce798b5-cee1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170337, "uuid": "1f504dab-ca08-4ca3-b20e-ac62bf6533e4", "comment": "Malware payload (Mirai)", "value": "f77fe82accf81ba1159a034d4efe6dfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170337, "uuid": "b1298fc2-68a5-44d7-b4ea-dcd8ffce5d38", "comment": "Malware payload (Mirai)", "value": "222cb4f2c2af563ec8c30971a018094fb639d8ae9d8a31215d1624c1d9083695", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170337, "uuid": "1856d714-c5df-48d5-8b27-5e0949b98146", "comment": "Malware payload (Mirai)", "value": "18767be7ffe46a6d4b04ccdf2b5df2c86fbfc663", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170337, "uuid": "c2aeeac0-7ce6-4da2-bec9-028826b6bf30", "comment": "Malware payload (Mirai)", "value": "8df5413ea551761f2c1c0e6b0e0db347c6704ae87c695691caa84b52d32222c79f57eb780da5485699604aa91ed0931c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170337, "uuid": "1fc793e2-5ec6-48c4-a077-653d46be551b", "value": "T17D83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170337, "uuid": "dc5bf1a2-f71e-4926-844a-494fa40348cc", "value": "1536:iVLyu95KnVkj752dCexuV/8UZlDwfkJ4MYfWs:iVLyMgYFezxu5VD1e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170337, "uuid": "3c8c804f-58db-484f-b78b-bfd133b7f422", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170337, "uuid": "da06d8d1-5026-491d-8b9f-bc1b2c60a90b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170337, "uuid": "b1f46964-71af-4d07-ba2a-8f45c02aeef8", "value": "f77fe82accf81ba1159a034d4efe6dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2240cea8-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196814, "uuid": "41bec4a0-7401-4735-b67a-87c600930a29", "comment": "Malware payload (SnakeKeylogger)", "value": "1ae4ccca6633523400e82012a824b000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196814, "uuid": "71d2fe76-3e2e-40c5-a7df-1ea5e661ec6b", "comment": "Malware payload (SnakeKeylogger)", "value": "22312746d00896e37150b6c7ba5ad6588dd9f50e71e1e70d7745f5b820f05ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196814, "uuid": "84e1c269-95d4-47ca-be2a-9eeccfd4d9c5", "comment": "Malware payload (SnakeKeylogger)", "value": "ab1b26dafce2473f1e7470dcb5fe29b7a377349e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196814, "uuid": "a373aaac-f06d-4d75-9a1b-799b144f960c", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad5ccfe9d4b5991bbdd2b67a236b7210c086e2c70f35e2c886a022c4d421be0bb57c1ad21faedd8ed05ca0940939e3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196814, "uuid": "c8c0bfc5-7f1d-4195-8098-31b6694c6ad9", "value": "T1ED155ED1F190C89AE86B06F1AD6AE53025E7AD9C94A4810C56DDBF1776F3342309FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196814, "uuid": "aba299cf-6452-4592-8028-270b4005fc7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196814, "uuid": "873ed9c0-312a-4b6e-bada-3484416a9db3", "value": "12288:K9ZNybECTD9K8FriX854Sxrx0fb9sLhBGVRTtBimOMt+:K9zeseDu9iHCbimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196814, "uuid": "6867b7e8-f407-47f5-949d-d9f34e23c772", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196814, "uuid": "13f4eeba-f477-4d9f-b187-983095a28a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196814, "uuid": "07439330-4d01-4454-a024-148464f6aac5", "value": "siparis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593c7be1-cef4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680178438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178438, "uuid": "540747b4-ad08-429a-adc2-61e14fd44c64", "comment": "Malware payload (GuLoader)", "value": "880be8baa7e8706cf021e70c7d372c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178438, "uuid": "ba91a0ea-9f0a-45f9-85e6-d49d6cf3a76b", "comment": "Malware payload (GuLoader)", "value": "229bb814799556fa3fca643f2765adc46774ce29ec333285544b9654ccab12d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178438, "uuid": "20444110-998c-4984-aeac-710c05466f85", "comment": "Malware payload (GuLoader)", "value": "4a99d612502334f5539152850c4d7bcc3e4dab90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178438, "uuid": "e3717a95-cd9d-4a1c-85a0-c37e8a93f179", "comment": "Malware payload (GuLoader)", "value": "5e49e4eafa3301834bf89524380557e71acda13f1adfb1b6fa6da166d90b4faeae1b4555dac9e4bd1d1b4760f004b815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178438, "uuid": "4c27e0f4-74b2-440a-a41a-187bb7c61891", "value": "T18F4522107E82C8B7C6661BB05EB3C7706370FD5456128B0772E46F8F7EB25A299216BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178438, "uuid": "97cf6694-082d-4627-bf25-7556344f17ce", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178438, "uuid": "866c9add-a48e-41ad-a22f-301d3b3b67ab", "value": "24576:FO/lnSVs8cdltyHoLErmWV79F40PGS89mZxxPCD:FunC+dPGOEKWVbrPGS8wZxxPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680178438, "uuid": "60e17596-5122-4129-94d6-8dffa78ba502", "value": 1275712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680178438, "uuid": "1a6973ae-f190-4743-9143-897b92834be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178438, "uuid": "bf75103f-7c0b-4ff3-a64c-dd46b019cb44", "value": "Restabled.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4c35fd-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165313, "uuid": "90b11eb6-db42-4de5-b2ca-b796b63f0b62", "comment": "Malware payload (AgentTesla)", "value": "eb61f0650317529d7fb28c9d839d3612", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165313, "uuid": "2955f025-1fc9-4532-80dc-86907d8d07ab", "comment": "Malware payload (AgentTesla)", "value": "234cadb13e56e3214f609a0f493f2474e452cdfd3bb3e322e8cce51219032d03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165313, "uuid": "eb917ced-e89e-4113-bd9c-fee558426b49", "comment": "Malware payload (AgentTesla)", "value": "d26c96468c322b0148384ed7674eb44abbfa4607", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165313, "uuid": "8a0ae57d-4309-4144-8308-fe6c55fed363", "comment": "Malware payload (AgentTesla)", "value": "9285727aaa378d562989b28d88d2cd23dc701f3933ebd5b1c58d4c37c58b54635ff1dbe2c6d08436d90bdd25951f7a7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165313, "uuid": "29cb6db6-43d2-4435-a5c0-4086ea80fc51", "value": "T132E46CA7B643DDAADA18C6F918A5F6BC329059D42F50694DF20831C70CB937CEC86F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165313, "uuid": "50d72744-3f92-4efb-8046-eb2008ffb0b1", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165313, "uuid": "611f75ac-f5f2-443b-8e4b-8b4033fc387b", "value": "12288:RXbA6dvFFBKa7ofHS2A168u36ijLH8aM9Wav3yrtkfCmNkt9oiZVebjwQ/SAKIxU:RHvFFMaiHSTm6ijgrWavyOqmNkbdfmUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165313, "uuid": "b056bc77-e72d-45db-b4a9-a79a0c03f42f", "value": 692358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165313, "uuid": "20cacb0f-577f-41ed-9d19-775ff9a6e4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165313, "uuid": "65f379ab-dba4-42a1-b74a-f6dfe14165fa", "value": "ADCO RFQ 007443111409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558364b0-cec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Lu0Bot)", "timestamp": 1680157816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157816, "uuid": "9c36c5ff-4b8a-4a86-8dd9-5a18533e8949", "comment": "Malware payload (Lu0Bot)", "value": "5dabc5d17c823834d74fa0a29c138d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157816, "uuid": "bde0ccc8-975e-4a65-9404-2793e82bc3f8", "comment": "Malware payload (Lu0Bot)", "value": "242467ea19694c0e6cd76dcff901f5af6a309c2c999971b1dc4cd9bad253ea19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157816, "uuid": "12d7a3e0-a552-49d3-b7cf-9fa9f0c86d49", "comment": "Malware payload (Lu0Bot)", "value": "c7e69a1566c42bd30861409379a1fd262b421d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157816, "uuid": "07432431-0c2f-4363-a04f-fb22d009bd03", "comment": "Malware payload (Lu0Bot)", "value": "7cfa6cc4f96c191270732fb7af7f1b3ffb5ef6f9d468b3f9db58c608c9359239751d7628ebdbbf4c24b2d21250744c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157816, "uuid": "1e84d2c3-c9a1-445b-b2c3-f49e290c16fe", "value": "T124B53316A6F081B3DCB91F3224B216D30139BC72C62E4B5B3B45285E1B736E1E13A7B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157816, "uuid": "0ae9e313-9d3f-4dce-b8b5-f1c0d31ce40f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157816, "uuid": "6e7c63d7-0da0-47d8-9689-1e18c922f59e", "value": "49152:tB0HYKaYysNLxZFNxvyw30i7YTBxxFTPDXqDS2S9r1N:zWYwPN9ZDv0i7U7TPDXB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157816, "uuid": "5f95e3a1-53d1-4dfa-9470-e2c34c41eea6", "value": 2298368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157816, "uuid": "088bd044-b391-439f-b91c-ae8f94a09898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157816, "uuid": "d3809cdd-f38d-48a6-b0d1-7fca84907877", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0c11c6-cec2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680157077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157077, "uuid": "eb5bbcdd-beca-48cc-a704-13a3c86d02d1", "comment": "Malware payload", "value": "75d64933f52b320b81078883d20780e8", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157077, "uuid": "b05fbdc4-619d-4af2-84d3-3775aeffab8e", "comment": "Malware payload", "value": "2433322c9fb62dc50899dc947963cd03c4c9e07085001c7476239e6b03f6b3b8", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157077, "uuid": "94849e0a-d0ed-4c5d-a4e4-c11e9b67f74b", "comment": "Malware payload", "value": "df5e80c46af043e1dc2c1ca98096f6be280be0df", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157077, "uuid": "79d24371-581b-4cce-b4b2-0787e3847d54", "comment": "Malware payload", "value": "5f10ad1698cbd470af2971fde769c770b9747731d9e4db44b4db937f45c992534e1f3d47f2c0326eaa57c6b9e69bafb4", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157077, "uuid": "b27ae1f9-6faa-400c-a7aa-0dc4f3c8f568", "value": "T1F6B56AB122A3FDC5D77F1DB480142540EC54696793ACC64CBCC92AAB93E9714EFAC6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157077, "uuid": "eb44cf82-4b0a-49c1-a3d2-9121db494af4", "value": "24576:0RRjtXhynlZoOlHKtu1Dze6HDpLVq8Hz10D+LtNVMdMm2NLwASieXLHfMiLiKeXL:ERRXh49+4o5IjafLLioXMLrRRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157077, "uuid": "7b14135e-7de7-4f2d-adf0-01c94ecb6d09", "value": 2484224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157077, "uuid": "bb0d5fbd-4fc6-4432-9414-c6864c590209", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157077, "uuid": "79c2203e-d6ff-4cbc-89b7-86cd6d50dea0", "value": "New Products.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2124a330-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165029, "uuid": "e4b4718f-2ad6-4198-a63f-d566ac4cd89a", "comment": "Malware payload (AgentTesla)", "value": "f0184d7d5a4112ddd3a2016abff85cba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165029, "uuid": "37ca8953-50a8-4b97-b004-50124f4b6c80", "comment": "Malware payload (AgentTesla)", "value": "2830200c6f723cc10db5cf9a9cbfa43a36d2709cc4150b6ebae51573eb68115a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165029, "uuid": "a2c76798-d46a-4514-9f9e-b1c4d9ece3b1", "comment": "Malware payload (AgentTesla)", "value": "4d6dac2b524a2c7ceedb8139226da7814034969d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165029, "uuid": "94375dfc-ae55-4929-81bd-2b6f47e15bd4", "comment": "Malware payload (AgentTesla)", "value": "53dd7f502172640d149ab28b218264923f84c22a43f5cff3fc47371e7a83fe70d0c2d15f46aca5899e6921e75dd13ded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165029, "uuid": "9f9d0c61-a9aa-4872-a43a-c52036470f3a", "value": "T18115E000BC650867FCDAD7F02465273A03E67FA95471D18C8ABA79982DFBB5300DA61F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165029, "uuid": "fe38708a-1af6-4f47-aac4-7bb201d0b61e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165029, "uuid": "f38cf7ca-bd26-43e3-a715-fca90ff172d0", "value": "24576:W8QKtUZGrxsYytnhkG3+R3NWm3HNcYOjS6r:PQKmZTtKySN33S/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165029, "uuid": "58b43557-7fd0-42b2-8bc9-2ba07abb21e8", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165029, "uuid": "f997cb27-5382-41f2-bcc5-7deea2d51486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165029, "uuid": "e4db4193-94b0-46b2-bfe4-e51d8bea59e0", "value": "105 produtos listados.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ed6a2c-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680198320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198320, "uuid": "10282550-6180-4c61-8dda-6ee405dde730", "comment": "Malware payload (AgentTesla)", "value": "0c0107191092b26ecbcb2b364249d6f6", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198320, "uuid": "44f8588b-e743-4b7c-bc22-15c1638078f5", "comment": "Malware payload (AgentTesla)", "value": "286a906b91ed5c46a05db9f8db2cdd1b50e6cec2a4574b1ad05768e805999764", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198320, "uuid": "0c78ce45-43be-425e-ba1d-c915d7de354c", "comment": "Malware payload (AgentTesla)", "value": "806ad40b1a69658ee5d8f7c44f442e51ff075c4a", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198320, "uuid": "ce66f613-b34a-4112-ae9f-f86afea3f1f0", "comment": "Malware payload (AgentTesla)", "value": "dbcdb3317005c58693dc5977c8a561e8ca889b66877a1c5d5d8ca18eeecd923cfd1fac24f20e78e04a8dc39755241872", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198320, "uuid": "d4a55fa7-dde0-469e-b1e3-32a72412df82", "value": "T10883D625ABE8962AF2BF7B315C7113300779FCC6A961DB4F9C4434CE1872B88D911B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198320, "uuid": "e107e453-6f68-4261-8882-54c8f97216ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198320, "uuid": "403e778d-0c53-4828-b553-e8e5b210ad68", "value": "1536:q+w1SkLnhUz6RhpJj3lbYiK0GMYe2atgKYa:aJhKmhpJj3lb00GMYvat5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198320, "uuid": "52261963-b29f-46fa-a059-493ea8b4f092", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198320, "uuid": "7c691e4f-6c4f-4fb0-92da-31549b988bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198320, "uuid": "2af7d497-0934-4a3a-8fd7-45c90f65e118", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f181d03e-ced0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680163231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163231, "uuid": "598a0bcd-ae4f-4a1a-80a0-0c46e551fc43", "comment": "Malware payload (RecordBreaker)", "value": "27f18348b5f439bbf093145f585f4501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163231, "uuid": "3f026738-29e5-43fc-8ff8-0400971e4063", "comment": "Malware payload (RecordBreaker)", "value": "28eeba65787422e3bde080d3874913f0463496763405007e05725ff636903838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163231, "uuid": "29b785af-8900-4a5f-b684-aac5d794cb8f", "comment": "Malware payload (RecordBreaker)", "value": "6f2c336a3348282add6c29da5010ba895eb690fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163231, "uuid": "4634b668-9dd3-483a-8cc4-5c718e73b10a", "comment": "Malware payload (RecordBreaker)", "value": "78bf6852dacdcddd3734b47a5b325f6b365d323d21259137506f993ca5cdb8eff5c7f77ca896300d4f083e6f89310abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163231, "uuid": "28fc8117-b5e6-4c6e-980d-9b2002785cc9", "value": "T179246B029EFC7870E23347368F2EC3F82A1EB4617E15BA5E16595A3FC5B43A1D622315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163231, "uuid": "650409c5-756f-4dbe-b1b7-de603be9625a", "value": "09829a76b54b4835c677dc6fac4ef621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163231, "uuid": "9191b855-18a4-4c0b-b760-7de32d78fcc9", "value": "3072:rp8RbozBV8qyWg6SlTUbC4vtpQJ+BH4BR90VbSTiFEuPM5sRzITsA:rMcn8D36SW4+BER2VmTiSuaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163231, "uuid": "a2694d18-19bb-4a39-ba49-5653e9a9704b", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163231, "uuid": "0738f043-aca0-43e5-b844-576f979e9256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163231, "uuid": "28ae61a6-5446-4c43-a95b-012d90875834", "value": "27f18348b5f439bbf093145f585f4501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a0cad1-cedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680168666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168666, "uuid": "c62222f9-db76-4acb-aa60-27e8bc189b96", "comment": "Malware payload (Formbook)", "value": "90effecf870c2d251059d80098bc80ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168666, "uuid": "02913843-1135-4a2b-8bdc-45d840d2d999", "comment": "Malware payload (Formbook)", "value": "294e9a6c09e5242d55e9e755771106bc7aa0b1e3464e25adf056784a6b9496e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168666, "uuid": "67c4dcf7-06ad-4f53-ac86-8733ff42f4c6", "comment": "Malware payload (Formbook)", "value": "af107a624d59a9799f8afc87cd16b2142b766f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168666, "uuid": "3aee769f-cd01-4176-9afd-12be5692d2a4", "comment": "Malware payload (Formbook)", "value": "84606e1526cd293c0f009883524051ed8fa952354d617febc82cc2ef762211ee08edb14057ddcd5775b2b887f43c8f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168666, "uuid": "7f5401bc-7f43-400f-b4a9-fd54748651f3", "value": "T16B542318F7D0D4A7E1620BB85A3D5F6957A7D41606A9C50B03F0EF2A7BA3A80D71F360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168666, "uuid": "753133cd-e3b9-446d-92f7-4ad8379c1447", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168666, "uuid": "e897a124-d7ef-4092-a9e3-2c0a0f2807d3", "value": "6144:vYa6Z753wToe1dbJtMO34JCRv+z8r54aX8XXLNlv9ZKuxj1DdhM7z44t5:vYr7dIoe1dbJqg6CZr50Hf/9ddhM7z4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168666, "uuid": "d7aa6053-c935-4dc7-9ab0-065d30630e5a", "value": 299633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168666, "uuid": "caa192c2-d997-404f-9c00-8a93ca5fd643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168666, "uuid": "eb8171d4-3f64-4c7d-a3a8-4f3fbb84df50", "value": "Swift30405830330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccdad3d-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680196993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196993, "uuid": "2fb53eba-ff60-41ae-8fe6-f075fd739908", "comment": "Malware payload (Formbook)", "value": "3c99d9a677643e85b74a6a7dad1a175f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196993, "uuid": "8c08979e-c7f3-4ecf-97ee-8f10bd72eda2", "comment": "Malware payload (Formbook)", "value": "2963a9c39909293e60f5ba8a19cbf738db2ddbdd043b5dbf85880b8cdb049ad1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196993, "uuid": "e352f89d-1924-40d8-b478-35194f5d830c", "comment": "Malware payload (Formbook)", "value": "05571307fc4e7495aa4f6593fd970a48ab700081", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196993, "uuid": "1046722a-b9c0-43a0-92bc-3ab8fbaa0d33", "comment": "Malware payload (Formbook)", "value": "e5fffcdc4d180e263bca0a7895c7af625a69eb68a81193ffe0058b0f760fc99be81a024af54cd7ccfc9227843dcf55f1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196993, "uuid": "e104cb4b-67ce-44e6-8be3-f32695f170f3", "value": "T1C2351223F901DE87E08987B05F972ED5830DBD82B35668831548BB6F9F316E8785B24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196993, "uuid": "35f01ee1-f9d7-4aa4-b736-a5a7e53842ae", "value": "24576:gLKmSSMMednE0akAmmjmRakAmmjm3+MXUHgvmE2222222222222222222222a2Th:gLKKMPaaoeaaok+MXypWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196993, "uuid": "ccc99c65-f7d8-4c3b-b7d3-71c8f5c7ad2d", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196993, "uuid": "3a0bf01b-db7b-4992-bf83-0d1a03bd97c2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196993, "uuid": "686e07ca-0c63-4f7e-b278-3e5dba53035a", "value": "New order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13660e6e-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165006, "uuid": "bf4c0691-d337-4447-a847-9f44bd656503", "comment": "Malware payload (AgentTesla)", "value": "83269c510650049f95e64b9a361a0a4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165006, "uuid": "5a489aac-ddd1-4f23-ac25-1d6d51eef834", "comment": "Malware payload (AgentTesla)", "value": "29bc3dd2eb4152dc7b07931220b78087a98692e2dad419068b947fe62ee6429d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165006, "uuid": "54ea4cb5-4d84-426c-89a8-5f0bd16509a6", "comment": "Malware payload (AgentTesla)", "value": "35cc1efa2086d42ca6b29921c88e5f1cb5b850d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165006, "uuid": "2f251733-fcd7-424b-ac4c-8f2748cc8050", "comment": "Malware payload (AgentTesla)", "value": "19529568cb3104d6e7183c7b0bb3c73560b1f5ceda015eb34794c86ef339fcfd783798efffe0b0b5157b5f39180c3c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165006, "uuid": "3024a5a1-a38c-467d-80b4-9dde39e78d5b", "value": "T14E754A41EBA61460F0104579216B7D1FCD62AC8D99EDFB6E190FFF31F5F220A5C92A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165006, "uuid": "121a33f3-d5be-4f52-bbbf-576e88e3c9ff", "value": "12288:ZQ3PlYuO1222PwXPzVWaqhP3C+FyFxHhZ89VPbNEdF8gKJSaK9fVu/8pt9r/lWvp:ZQ3NYV2QzVZqIRWXGIgXawRptBlqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165006, "uuid": "8e91696d-afe5-4d99-8b1b-1bfb92897c7d", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165006, "uuid": "aa68bdf5-5280-421a-b3d7-1168cb9677b6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165006, "uuid": "60ae90a3-4b73-4d46-87f0-d5371a94dc5a", "value": "Quotation-092834.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cd676c-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680165166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165166, "uuid": "f2ce9d4e-756a-479c-b3b6-86f87ee92fc6", "comment": "Malware payload (SnakeKeylogger)", "value": "9710dd70d16145b8ba60185ac215d68c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165166, "uuid": "ec97e7d9-3ac3-468b-b8cc-e8fc59b9c698", "comment": "Malware payload (SnakeKeylogger)", "value": "2a3b878db3d93241bec1fa344d59275cec331fa159ea90c26d8430f4f4a5b9e5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165166, "uuid": "452993ee-7943-4754-bdb3-e11b7509be75", "comment": "Malware payload (SnakeKeylogger)", "value": "36879b8dda6dc1fc0e3a417bba3889916f2ab6d7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165166, "uuid": "b7f52e0a-d01d-42a5-b1b1-db2fb286a61a", "comment": "Malware payload (SnakeKeylogger)", "value": "f5f6dbe3ceb4ae521bdeb26e872d222c3d4267a998d6de670c66142dadfa383fa938672392e7efbc08b84dc7044241fc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165166, "uuid": "afa2d44a-5708-4112-bacb-de24245f741c", "value": "T1A594017A7A63C413FA543B3929A2F77D5320B8987E1D2B0732807BEE7C335564C0AA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165166, "uuid": "ddc6792b-4e23-4925-877e-91787e37d01f", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165166, "uuid": "0a736c2a-62a1-4dd5-b62c-6806cc56e07a", "value": "6144:8BeMoZqMFv+k0Qoddeop6r8BGpqGHXDGr0QXKVhQVGefkOzEDVlj9PHihb:ioZqMpB0QodvpA8BmT6QxQlCDPxf0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165166, "uuid": "cfea80ee-b661-4c96-a325-07a8807100c3", "value": 421208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165166, "uuid": "e442fa6e-271a-4915-94dc-8d8c0f939d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165166, "uuid": "e1fd89ac-8cdc-4ba6-8493-603aaf14edc6", "value": "QUOTATION SS-220323.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f5ea0c-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680161674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161674, "uuid": "50c0b8cc-0e89-41db-85b8-dc2ae45760e8", "comment": "Malware payload (Amadey)", "value": "b34996bef5946e582f6cca8215eeba72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161674, "uuid": "9193add7-0087-4f9f-93a4-a7afdde82b16", "comment": "Malware payload (Amadey)", "value": "2a6130f3c743089b894126c1103a3ec025a5fb090a543b07d4b54510818c94a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161674, "uuid": "e23b435d-bd83-4cb1-8cb3-2ede18b644d1", "comment": "Malware payload (Amadey)", "value": "ea9e01bde1d4a38725c9c1ba903393dd78e137b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161674, "uuid": "be64e195-73be-4c9a-9d9f-9b1fe46cfe73", "comment": "Malware payload (Amadey)", "value": "8b7d8e792d9667abad6ca5e10d0b9c658bfc9387b5eb4322d995d1acfea7d4b1181335cf3aa11f65d56ddedb21220ebd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161674, "uuid": "84ff00c5-5c8f-4d6f-8975-30522a719c09", "value": "T1D3252222BACC8466D96A5B3024B303C30D38FC628C78D76B27D6296F58727C4B57576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161674, "uuid": "fbcf62c6-b5d3-4cca-8aa2-e922459f8573", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161674, "uuid": "069ab276-d5a6-42f6-bd20-8e8ff568cf5a", "value": "24576:RyBOt/v0ef574kY/h0W0IA4r2gRZbK7o6driT:EBOVv774b/SW0QRZb6oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161674, "uuid": "15d466f7-4d38-4984-ab4d-8e9fc48d02ea", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161674, "uuid": "5f6ac5d1-8480-4892-a784-fa33322f3a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161674, "uuid": "c2605ed7-deb4-4459-96fa-05b7c978a37a", "value": "b34996bef5946e582f6cca8215eeba72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b3347f-cf24-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680199073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199073, "uuid": "f364a0c0-6f4e-411f-adf7-5b580079f878", "comment": "Malware payload (GuLoader)", "value": "b6109aab2d2a51ea0c6f6b28aa2a869a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199073, "uuid": "ef4d16c0-3d0d-4a52-9982-bd413d389c04", "comment": "Malware payload (GuLoader)", "value": "2abb89507bbcec354ea3293c13851505059ade5b0b6070793cd69e44e01dcceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199073, "uuid": "4af84537-52a5-4c4b-a099-dc39b70bfa49", "comment": "Malware payload (GuLoader)", "value": "c02f08dea05b56f953b5c724499c552dc7126c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199073, "uuid": "f62bc2ee-9a64-4c30-b64a-28c7dda8aff8", "comment": "Malware payload (GuLoader)", "value": "817eea292febb8125e727416dc7594311bd601c23b594b05fa256440caef0c5b990c6fa27005ac0cc5e8a47120e7af39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199073, "uuid": "2828f527-2826-402d-bd74-dba50dccc8a2", "value": "T198F412507B98D843E3A0227461A5F3BE4F74ABB82D1A8313D6F63C9F7628F565C29311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199073, "uuid": "cad3873d-d97b-4275-9daa-049e613a7a3e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199073, "uuid": "9e5ed788-8788-4032-8620-99e2e20f9167", "value": "12288:/ghti/pICWSh/cg9E2bCVGpzOH/8/6l0ankiuhSnRTt1q15WkndorDNJcaugJjUJ:4O2ohkgO2Goek00ankzhSpXq15fndorw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680199073, "uuid": "172f624e-fd97-4189-ad80-b7fec65dcd9a", "value": 785753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680199073, "uuid": "742a340f-afc6-4ba5-b4df-581e97899635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199073, "uuid": "4cbf70f8-4d94-461f-8493-0f570d9bf3be", "value": "495b0122-e196-4271-8992-bc9b22c8a5af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d2b461-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680196976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196976, "uuid": "02015308-4d27-48b7-b60a-52d5bff5fca4", "comment": "Malware payload (Formbook)", "value": "60042025d6ecc037617357c6e9443778", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196976, "uuid": "30ead165-a6af-4d81-98ee-8b3ec9506264", "comment": "Malware payload (Formbook)", "value": "2affb96bed966f1bc5ec7c83d6dc5b1dd91a6fb2c4167f4be76a16b89194331a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196976, "uuid": "eefeb012-eec0-4e85-a571-39706c8246e9", "comment": "Malware payload (Formbook)", "value": "bc6ba03d3e2299b3ee9bd0e121088b6775048c57", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196976, "uuid": "141d22bd-a794-4573-a3c1-43736ee361bc", "comment": "Malware payload (Formbook)", "value": "0398c50b6a275dcf3962cf5e76d80d6e724a611d040d021bdaf2456d114f65aef3488f53b6b83af658be3c5f89978c48", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196976, "uuid": "f75c795f-8a89-479c-a053-5c67fc8a9322", "value": "T18B351223F940EE87E15987B05F5B2EC5831EBD42B397688311087B1FAF712A8795B24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196976, "uuid": "cebd3107-bc58-4627-93aa-e6d30957e914", "value": "24576:mLKbSSMMednEfakAmmjmqakAmmjmc+MXUs/+X222222222222222222222B2LLNk:mLKlMQaaotaaov+MX0TNJSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196976, "uuid": "3b726278-ab0e-4a48-a70f-3b9411415143", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196976, "uuid": "e2db486a-ca40-4f47-b05f-2d22bda79302", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196976, "uuid": "81f83ff9-90e0-4766-aba0-ab3e220fdc67", "value": "2948_001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dedf2f-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196785, "uuid": "adc51b1d-6491-47e9-9094-ec16199f2d90", "comment": "Malware payload (SnakeKeylogger)", "value": "466fc057c674b3d99ac4951bdf919da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196785, "uuid": "5673325b-efb1-408a-9a11-b1781d51c4e8", "comment": "Malware payload (SnakeKeylogger)", "value": "2ba96ffeb81c76fe74a0c12ceb229ab49654fa187e22d58dadaa443f2d4bfdd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196785, "uuid": "f0b7f170-bdc6-4598-acd1-bc77b32a30b0", "comment": "Malware payload (SnakeKeylogger)", "value": "c36e67da419f1462099c4a053e5e02ea09a563b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196785, "uuid": "eb822202-ac8e-47fd-aa40-a7f366cf9932", "comment": "Malware payload (SnakeKeylogger)", "value": "4a58dd0f66cd308a468ff26231861ae17e3e57168676c502927ca203d002a3e93423883291a07515f11bdfe6bc6d4f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196785, "uuid": "59187801-f075-4706-a38d-a6905f8e1053", "value": "T11B255DD1F194889AE85B25F1AD6BD4302193AD9CD4A4810D67DDBF1B76F3382209FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196785, "uuid": "e24ed267-1f47-43d6-9861-c3382f603119", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196785, "uuid": "7fba8c3e-75ef-47e0-bf30-e30ca70ffc4a", "value": "12288:77UHzuKI8wHnWfiE+LKV2LD9IFV8P/5lYpkimOMt+:V+wHWqE+eVYD9eVG/DimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196785, "uuid": "ca34a933-baed-4cd5-a3fe-3743f9faf28e", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196785, "uuid": "cec0e5e0-7994-4017-aa78-9eee7db06b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196785, "uuid": "6c6057bc-a15e-4fec-ad3b-60b84e563db5", "value": "kredi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e4d899-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680161199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161199, "uuid": "d29a5fee-8a80-4e33-ab2a-e19b96646445", "comment": "Malware payload (SnakeKeylogger)", "value": "d5823a84e4b8e1cf3d66e71c0bfdc634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161199, "uuid": "e4854cbf-29e5-4e0d-a28c-c5693de6c4db", "comment": "Malware payload (SnakeKeylogger)", "value": "2c02e5bec85fedefe1d21d2cc02b0d7e91eebfedcb53f444127463987de67bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161199, "uuid": "867ac573-c4a7-4944-b2d4-419989740942", "comment": "Malware payload (SnakeKeylogger)", "value": "6f21f997a4f810f899bfe07fbeeb231c3594b773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161199, "uuid": "80353211-35f6-4979-8361-879fbd12625e", "comment": "Malware payload (SnakeKeylogger)", "value": "637dace08cdfb598b2e874fb6e23d27024f98f56892074054eccfc8118539dfb1294d25106ce16563cb76073dadb2638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161199, "uuid": "2b822488-79bd-40a9-9333-8c1ab0bd2b81", "value": "T144D4F8F9B260C1AAE2BB46F16D2B687421F79CAD98D0421D26BDB71C09B271111DFD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161199, "uuid": "333a8683-5475-45b6-bd11-5fb56a047415", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161199, "uuid": "372f9697-bee0-441e-87eb-482a6a6881ac", "value": "6144:sMm4CCHM4NL26fgvQVA2QNzTlIWFLVEXeVwp9gSGmsBYnrfs:sMwg/NL26fgvQK2QN6WRVAgSGm+Ynrfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161199, "uuid": "3138089f-f275-45f5-be52-f0425d69aea0", "value": 637582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161199, "uuid": "10ced42e-d8ad-49f1-baee-bcbcf2145066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161199, "uuid": "48ef198b-aff6-41bc-822c-11dcbd823762", "value": "OPH21.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99558b1b-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680160936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160936, "uuid": "82d9e059-0268-4671-a344-5df0942286c7", "comment": "Malware payload (Loki)", "value": "04128857f07593d5f3a35def3e79d1ee", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160936, "uuid": "17705b1d-373a-4866-976d-46e72fd50aef", "comment": "Malware payload (Loki)", "value": "2c05c614587d7f5ef44e3aaa815853cb0a32cf3bf15da81df77c42d5abc5a290", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160936, "uuid": "7ec2e734-7e4b-4cbc-a9b7-c8cd57262d9c", "comment": "Malware payload (Loki)", "value": "5da94b438de46224200d89510121e2ef0f637015", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160936, "uuid": "b0f0156e-0128-447a-bc6b-95acb5f317d3", "comment": "Malware payload (Loki)", "value": "1ed77d60d880049e7cd6cb83aeff1021ff907ef00bc30a2c4acf0fd47aa27db524c5e7493139e6a29d4b02e4ea528b05", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160936, "uuid": "ef9d0882-ec85-45bc-a15b-d4ed65176265", "value": "T12A7423FFE49EFE5697274A2A3C4EE06636D71D9394A1A04ECCC8AB08C5260D376D3315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160936, "uuid": "197a48d4-7b5a-461a-be07-2f78a9065419", "value": "6144:L/pxBSakKPEgr8LZtVjV9+V/+DrOMOCZigeb6hNbGvikKs3r97hcWbhTfo8K:dxBSa3PEggLZtV5IV/ISSeAbGqkR57h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160936, "uuid": "c0560bc6-479c-46ec-98dd-ab03881184da", "value": 365301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160936, "uuid": "783fd276-9a0f-43ed-8ae8-2c21e9bf9d19", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160936, "uuid": "5a757c21-aa29-4707-aa46-5cc8db920765", "value": "quotation_3246uu.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18863ff7-cf20-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1680197227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197227, "uuid": "83cef898-3109-4e9d-8dc3-868d521a5750", "comment": "Malware payload (XWorm)", "value": "707bffc466680fecf7db976a9b54d00e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197227, "uuid": "1c809d7f-ddf3-476c-b163-fb4f4049e5e0", "comment": "Malware payload (XWorm)", "value": "2c2526def5ac97d4f1d09403ef1febe5ecb0492de64c2d539db8760f2da27ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197227, "uuid": "8c81c510-b066-4ec6-9b98-d8bc31e9b755", "comment": "Malware payload (XWorm)", "value": "64eebce44a3543016c799f2eda4366e5cb0a6b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680197227, "uuid": "633070cb-b067-48a7-9cf6-d644adc6d3c6", "comment": "Malware payload (XWorm)", "value": "f3d0a280ed71a5152a0cf0b9f948f6765841b208d19713681d27ba5f7a9978ec00130947652ad409124005e25b64b5c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197227, "uuid": "72824b20-b19c-4922-ac91-76ff1611599f", "value": "T10A34D8E54A48C5A6E16F4F7850720C1602EBEF66F826F38F6DD070869B7B3C3542265B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197227, "uuid": "8b591a25-6408-4a14-9ad4-b2ceb27dcd90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197227, "uuid": "9c53e8ec-5713-4960-bbe2-b073d913366d", "value": "3072:bgEv6+C/py+C+V7LOp4Lmui9ZW33KBetk:bgEtEppNHmds/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680197227, "uuid": "358ca8be-7621-4adf-8782-b159bb0b8cbd", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680197227, "uuid": "812a8429-cf1e-4242-b1b1-961b5d8bb928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680197227, "uuid": "31b1c78b-1fd9-4763-9e31-852e24ac4e4e", "value": "defr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f10c64-ced0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680162992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162992, "uuid": "b2ffe709-e603-4392-bacb-fc5dfa02621a", "comment": "Malware payload (Formbook)", "value": "84b1a868b7548f28f81d4106e04865cd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162992, "uuid": "15faa0e6-2ae5-4ad7-b328-1e967a4d0f75", "comment": "Malware payload (Formbook)", "value": "2c5e1227d800ac006f701a13c4e1860bd9400aa661451f994e234599a8770cad", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162992, "uuid": "e23c199c-7fc7-477e-b326-19a6b2b1f4d4", "comment": "Malware payload (Formbook)", "value": "30247d52d21981a2c3706f75e4db6e2804668518", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162992, "uuid": "bc124149-9a1c-456c-b652-c0a565217ebd", "comment": "Malware payload (Formbook)", "value": "b985ce561e6d7b93e4cca0fd656334c5d777f3a13c383e193d96f1422a2f88d43a229fc18ffd4463f2e20bfc171961e7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162992, "uuid": "d4213a9b-442f-43ad-9b0d-9aca2fc2fb55", "value": "T1D6C423F10B0202F173CE84E54F5C64DA07526A48DB459EA278EAC792FFDD45EAAF4311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162992, "uuid": "9f21be24-0cb4-41eb-a055-94bc9d33df68", "value": "12288:TYq43qXMhFai3hpVCFZvO/jlCe7fd5OxvVadldyidXf:TLiEwpYFlWH7rOxNRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162992, "uuid": "27d7e885-ded2-4a8b-86a1-adf0b7fa021c", "value": 595317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162992, "uuid": "d0943bf8-8f7a-4dd7-95d2-70ce83210a0d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162992, "uuid": "50540eb6-4ca7-4fff-8bea-7c9dfc721882", "value": "copy PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ad3684-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680160762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160762, "uuid": "1581fbc4-b68c-42e7-9e34-275f1cd68474", "comment": "Malware payload (Loki)", "value": "c4e0f1f7c7fb4cecbe00c9d0c19a2837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160762, "uuid": "cd802ccb-a065-4e0f-ba52-f04036b84590", "comment": "Malware payload (Loki)", "value": "2cb7bc593a5b4701b76d20ba93ad4e2dab62eb3b81dbc9f59965db44dafc97b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160762, "uuid": "35f63e4f-7571-44f2-900c-c2f009f21c2d", "comment": "Malware payload (Loki)", "value": "ce2d6a65dc6bcc8fd8b22ad3d1a774697cd8bcdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160762, "uuid": "93f7e1bf-c1bb-49d1-bb8d-399c3ac3e4d9", "comment": "Malware payload (Loki)", "value": "80a26f49080aed8c0cd6293dd09441def3dfeee5f98e70ad9152dbfc518d39a78f118d6336fdae807a01eba38d840353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160762, "uuid": "ff89332e-01cc-409b-9479-b5cca8dd9267", "value": "T124C422902381D01BD9215BB1D573D568EBFAAE10D7376A13272C3F6F7B32E814924B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160762, "uuid": "ba877bfd-95bc-4d0f-b79a-2b1eac8d2ea0", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160762, "uuid": "1ee97e1c-bbc6-4d05-a47c-2e42c7ae3e7d", "value": "12288:cqp+8Qve8l8NNylCKrlsj1Mbt491XLlHKxTzLSS0/K779NKKc06Kux:48Ue8l8Nsl/uGK1XLVKpF58h06Kux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160762, "uuid": "c04614fe-4076-4dcf-a810-12a4c0f1dabb", "value": 566472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160762, "uuid": "0abe487f-95c5-4ea0-ab3b-c6f2a62e37a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160762, "uuid": "5294985c-d227-4a92-a746-af47fc34db21", "value": "Quotation_1441_22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b969e7e0-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158413, "uuid": "e211405f-33ca-436c-a27d-893a33b689a3", "comment": "Malware payload (SnakeKeylogger)", "value": "729d63ad50dbea9a1e1b4da8e7fb2003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158413, "uuid": "81cddf30-43a0-4520-9806-154e74937de6", "comment": "Malware payload (SnakeKeylogger)", "value": "2cf6b9480c8c7a3e9ecfda6a28bac4f48f019d35f75d89847c8ef866aef2cc98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158413, "uuid": "7f9d49e0-1648-402c-8de8-661e84ca4d90", "comment": "Malware payload (SnakeKeylogger)", "value": "6920b5e389e83aa688a1e11faddf232dcd227fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158413, "uuid": "d3d2c691-f7ed-439f-94d5-207bd5a45920", "comment": "Malware payload (SnakeKeylogger)", "value": "9865d66aebf1db5aed27b97376fcd01d4ddf012358d807ef07121d909861d25ed01941cc490db14aa3dadb7c2cd114d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158413, "uuid": "b223c01a-a6a4-44a3-b1a7-b0edf30c748f", "value": "T1B0D4015436ECC51AC968427A81E4C2F113B9CCC9EA69C7270FCEBD87B3CE34A5525297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158413, "uuid": "414235fd-92ff-425d-b36a-2c9c3db76069", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158413, "uuid": "7b847c3b-f529-4e7c-ad6e-e045f936dab8", "value": "12288:XeJ/sIWuRehpimOMt+3CCSiUCxtAHYR4HdPomry3dMDnSrd2YXjokfi:uUPimXiKAt+HdPo92nSh2Iokf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158413, "uuid": "55b9b430-8d30-488a-83ad-eb912e538ad0", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158413, "uuid": "a5b54a09-4da3-4b42-9a56-d0f5f2a6904f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158413, "uuid": "aa0cc2d4-6e06-429e-87a3-0e09dbb457b5", "value": "gtt1EJtSPWs5hfX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5e74b0-cf23-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680198846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198846, "uuid": "ac4a443d-90be-4a0d-a44e-ed424d427427", "comment": "Malware payload (AgentTesla)", "value": "a4922460a18c2133dd7cf50f5c7428a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198846, "uuid": "6d0c66cd-afa1-49f2-9c10-2f41202cdd14", "comment": "Malware payload (AgentTesla)", "value": "2d839f4c436d5d238e52787682dba7eced27e04756bc15472f4e5e62c9805715", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198846, "uuid": "9ebb3c3b-2bb4-4542-b45e-624986a3e7bb", "comment": "Malware payload (AgentTesla)", "value": "b986952aaf9cf2bd684162de6cd2321545f2a6c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198846, "uuid": "22fd9d5c-18a0-413f-9d2f-8b56f61ce3ab", "comment": "Malware payload (AgentTesla)", "value": "faac3536a8fb7730ba717a2b4196ee0f0d69e1053207acb62648569b196034535f797d1d7b8b9df79ba1b3a2db333800", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198846, "uuid": "26431138-61c9-4bcd-a0d2-1df11a73f526", "value": "T11EE401643AD8C21AD015D23D91E4D1F063BADCD8E562CB630FC9FCE7B38E39A5921196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198846, "uuid": "42a378c6-c38c-47b0-9db8-dedd1d3c0b6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198846, "uuid": "fa6dc05d-6706-4a31-a9da-a0b34763b164", "value": "12288:GGSmdH9eGvay8s3KGHHhFda1RAN9ZXe7PmkVxpEgHfyRou/FvYxcjP18eimOMt+:GYdH9eGiY3FnI1RAteTrgSux7PhimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198846, "uuid": "5710f4ba-0905-4e7d-9a3c-43b1e1569b54", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198846, "uuid": "15de4a2e-5ce3-4747-9fa6-fa549b277f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198846, "uuid": "e9ca2deb-296a-4d25-a9d3-e827b77067ff", "value": "a4922460a18c2133dd7cf50f5c7428a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc590a3-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219191, "uuid": "52e47033-2605-4130-a7e1-726245c23389", "comment": "Malware payload (ZLoader)", "value": "dab402a1ceff08ec01fd4b7e7c25c5a2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219191, "uuid": "1015740f-6d65-4796-af62-d70fbf0bcbc9", "comment": "Malware payload (ZLoader)", "value": "2d925c92357e7b3b64f9bc2e7a3bcf7789954ff0985b85a69ba5994c137c8476", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219191, "uuid": "69476d1d-8bcf-4741-aa90-363f99da5d1c", "comment": "Malware payload (ZLoader)", "value": "a4c2395af6716e5ff7e8db3b59bbcdef336f015d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219191, "uuid": "1d8ea944-32df-47b5-b54c-1ae0ef083829", "comment": "Malware payload (ZLoader)", "value": "4306b091c2d4a1192921d6fc0776a6babb56ef92b81342cf3f00a836aadd6099737a8642004595fdd848b7c41f0f7a8f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219191, "uuid": "6d49bfcb-77ea-4d89-aecf-5e49a71fc1cf", "value": "T135F274E3BB95EE65CE48437A48A742906723EC415BAB83873355F72A3FB1BD04E02547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219191, "uuid": "7687fc8c-74ec-40d4-99f5-c2f5da4c270d", "value": "768:nPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ0AkyQpJxDpwcdEL/9su:Pok3hbdlylKsgqopeJBWhZFGkE+cL2N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219191, "uuid": "91cf9063-5ee5-4c17-99b3-590d2f8eaff2", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219191, "uuid": "d6de6bd0-2f7c-4916-badb-7101c6ae8263", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219191, "uuid": "44eeaf83-fd48-4b54-9f4d-0727fd493bcb", "value": "SecuriteInfo.com.XF.AShadow.1205.24655.10395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a60b9b-cebf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680155615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155615, "uuid": "67524685-2726-4250-8075-1e72366e286f", "comment": "Malware payload", "value": "9b653d1f5988bf0178c74104f4150a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155615, "uuid": "70f74edc-e1a5-488e-ba35-06ebdc05bbd1", "comment": "Malware payload", "value": "2db4adf44b446cdd1989cbc139e67c068716fb76a460654791eef7a959627009", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155615, "uuid": "86ea8c69-54d6-4170-8a9e-c12a1db02d22", "comment": "Malware payload", "value": "605607eb6aefa807b261493e5d2d9d0ca94ea633", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155615, "uuid": "766f1e28-77a9-4c1a-bd34-b6545d2a606b", "comment": "Malware payload", "value": "35a5860f11d7a770ec0985dba1145f450ed48bb22164577b29e171da7ee762e1f6cb07603ecbbc618555fcb26ce96f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155615, "uuid": "44176bda-f402-4a14-9ae8-431f72062400", "value": "T14DE57D27B8A214FDC59FD030975F8172AD34B8E843207E7B2295DA303E66EA01F5EB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155615, "uuid": "8955d369-cfc8-49e6-9067-140f053a764a", "value": "49152:00/Zhe0h8VlT/Jx0X/ekiMb30FkBylIM9tGxhWsU1Q2z816IU6iu+rXZypBvpfpS:0D7Y/hL0FkBCICsWsU1Qe81t+9XApp0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680155615, "uuid": "2a2487fc-d2bc-4a88-a87d-4a2ddf79098c", "value": 3127560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680155615, "uuid": "9938e8be-22bd-412f-92e5-ae4360fa4450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155615, "uuid": "7e868223-3ba9-4a92-a9a8-f8db86de1d22", "value": "2db4adf44b446cdd1989cbc139e67c068716fb76a460654791eef7a959627009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1beef8-ce93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680136808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136808, "uuid": "63ccc9e5-437c-4951-a7b2-c208297c2efd", "comment": "Malware payload (Smoke Loader)", "value": "3ceb925c3d5ab342ed0a07e25d355d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136808, "uuid": "bc499221-38e4-4877-abac-6fa40978df63", "comment": "Malware payload (Smoke Loader)", "value": "2ef14a45540f44048be57239820b9769012cdbe70410b10a95bb5fbe1c222934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136808, "uuid": "1859856d-27e9-4f5c-8cb5-358da4ad0c3d", "comment": "Malware payload (Smoke Loader)", "value": "1b12e8874a56d6d07ba0eae3779e9f1844d7e753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136808, "uuid": "619d7fe3-b9d2-45f6-8bf2-50b52b1477ce", "comment": "Malware payload (Smoke Loader)", "value": "77c99f4459f868d2a262e6cbb4ea9ebf84e616864b7a236476fd2fa9ea2fbe8ef60a64d3a7bab5c33335ffcd29045329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136808, "uuid": "d4718a9d-69ab-4817-8403-9059dac79094", "value": "T14244D012B791C472D91B0A794811DBB45A3BB8314B12CACB779C1B7E4E307E29FB6346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136808, "uuid": "87263243-983e-4256-95b0-8060439652ad", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136808, "uuid": "44028c59-91ea-44bb-b141-adbd3ce13e0b", "value": "6144:X+f6OeLELeM1us1kTBXL76nVNgEskrv+DL0GO:O6OyEqM1BkTBXkVuog/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136808, "uuid": "53ea23b6-42db-4677-bc57-19b255b884ec", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136808, "uuid": "5b511adc-0881-4f79-985e-ad9b449bb00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136808, "uuid": "f0492e70-bbe2-407f-b152-8e2760421863", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580790b9-ced9-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1680166839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166839, "uuid": "0f29260b-3c56-4237-9d9c-dd24a61a07c4", "comment": "Malware payload (NanoCore)", "value": "b15216131833ae02f4f05d5bb4dfea43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166839, "uuid": "144fd107-add2-4f2b-a233-292bad269dcc", "comment": "Malware payload (NanoCore)", "value": "2ef9e0b5a402e96b775bb1701741bb8af269dd6346b96827681da12912a55b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166839, "uuid": "77f06619-e838-436b-b5b9-b005923ee5e4", "comment": "Malware payload (NanoCore)", "value": "dc09861f62b55e50be77a1588a997adf9b80e410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166839, "uuid": "12d0b096-5080-4f00-a7f0-9281bfe58ed0", "comment": "Malware payload (NanoCore)", "value": "008788220cb4076670dc11e8ebe956e15a05ff2c5e52c744d34bfd77d7476f2073009310626f911d7509fd12aa35012f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166839, "uuid": "885d16a0-07ed-465f-8085-c8e743117072", "value": "T18B351202BBC198B3C5A30D364A359B21697CBE200F75CEDFA3905A6DDE315C0DA35B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166839, "uuid": "c2e65cb0-5f11-418f-a2f3-78d641049edb", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166839, "uuid": "ab2b1f09-cf53-407c-a3fb-580742933566", "value": "24576:lTbBv5rUaUUUUUJUUUUUUJDDpvm6tTjloM8WZQ6k+5zUMel:PBLUUUUUJUUUUUUFDpvYMdqwFUMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166839, "uuid": "0ea12e4b-169d-4f68-8596-9a8e8e64e99b", "value": 1157312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166839, "uuid": "74c254bf-12a8-4f31-8eed-319abb790b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166839, "uuid": "efd795ed-f78e-4630-847b-e1fc6a8584b0", "value": "5bd6af6f395bd4d577b0d3c97bc58195.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c972ae8-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161237, "uuid": "d3e58367-3a4d-43f8-a6a4-fdc60a4dd1ca", "comment": "Malware payload (AgentTesla)", "value": "58ee377b030f6d1a380b76eb27087448", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161237, "uuid": "e60ae53c-1191-4c4f-ab82-30b22a307aeb", "comment": "Malware payload (AgentTesla)", "value": "2fbfd8a6b905dda74da9df102c7e161a9e4128e733a838aa644504dfb742ecf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161237, "uuid": "ac077cac-9109-4485-8728-0a77ee182216", "comment": "Malware payload (AgentTesla)", "value": "62bff8fa4ab84a7809645339a67455e2ebcd17b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161237, "uuid": "93a7f731-6fcd-4824-90ee-6e198785f47c", "comment": "Malware payload (AgentTesla)", "value": "a790c2cb500ec4efd9161c91427e23a95ba5fcc212a7a2fb02d80303acaaf14ae0fd67ffcd8ca8339955edd076288cdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161237, "uuid": "d428aafb-885f-4b16-a9df-d8013f79345e", "value": "T1B2E4011436DCD22AC566867D82E4C2B02379DCC4D599CBA35FCEFD8BB2CE7069131296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161237, "uuid": "807287d9-c00d-4be1-bdc7-22dfd9971f55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161237, "uuid": "2d43c9d2-1264-4d00-a482-f97ced8ff5f3", "value": "12288:NeJ/sI+up7hnevR9sf14ekA1/zio/vdcUdm+BE6fqBgTehA3jJBYyimOMt+Mm:8F5S9LtA1/zioXeOy6ohAdKyimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161237, "uuid": "c17e9419-db98-4d6a-86f2-771d8bae276f", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161237, "uuid": "4126a81e-7486-4ed8-89ea-fb24aba79260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161237, "uuid": "794d7023-aeda-45f2-95c8-f772dc6d3f3f", "value": "DHL shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4612d7d2-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680161655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161655, "uuid": "874a425b-b58e-49e7-b196-f16535eaa431", "comment": "Malware payload (SnakeKeylogger)", "value": "42ece834e9aa72f3ec352f6bd42ef4d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161655, "uuid": "2e54a674-67bf-46fa-a4c9-7171d175ee95", "comment": "Malware payload (SnakeKeylogger)", "value": "30363755a78f3d0d939efc67ff623a1f2a4477ae8ef1f30b18fd57df43325da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161655, "uuid": "aeef3953-f1e1-4927-bb00-3ead99e7aa76", "comment": "Malware payload (SnakeKeylogger)", "value": "e4d362ef5a99078d878b353f87ed9fad68593542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161655, "uuid": "438a3579-d8f6-451c-b667-564df7453a84", "comment": "Malware payload (SnakeKeylogger)", "value": "f0816b9aec0f1a531ac46e5911d439b075516f7e7c266118d4ce05975336fc03f6810d9042b167101a7bff3d04ad5cea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161655, "uuid": "23be67c6-dd43-4162-963f-bf0059eaf02e", "value": "T139E4F15036DD8119C665C27A81F5C2B0633ACCD8E669CBA34FDEFC4BB7CA3895521287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161655, "uuid": "21fcac3a-058b-4f5b-bc6a-b270d390bfdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161655, "uuid": "2dc5bc13-d281-4f06-a9e6-3d7d24b7005e", "value": "12288:MeJ/sIGq4Ph+WxRtGm6dfK6dAncDszoNrsSHh7sIbTp8Pk9jjRUqjimOMt+/:xOLxRkm6di6Sc4cHHBbTp8sljLjimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161655, "uuid": "1944974d-97f5-45ea-9d7a-6a41019802d2", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161655, "uuid": "95d02dd8-6922-4046-98d5-3027e0498639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161655, "uuid": "db4dc5a0-5a26-4031-a7b5-fce52280104c", "value": "42ece834e9aa72f3ec352f6bd42ef4d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3507274-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170831, "uuid": "b7080609-8461-4782-a587-2cedbbc306c7", "comment": "Malware payload (Mirai)", "value": "079472cb8f9fcbc696cdb82dddc6f073", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170831, "uuid": "be06bf72-e351-42f8-a9bf-bcc9df5f9df6", "comment": "Malware payload (Mirai)", "value": "30bd4e741c0b2bc996d7bb60047b3071d9b3f9d2e0a54cb0aeec3ab790723e7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170831, "uuid": "22fb7b71-7454-43c3-af2a-a8b27e177041", "comment": "Malware payload (Mirai)", "value": "27d4af9bb781da703572daeb5f49381daacd8a8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170831, "uuid": "4fd60844-29e9-4589-803c-c882b2e9372c", "comment": "Malware payload (Mirai)", "value": "b2045934b3c3ebab8fbe43c822feee57edfedce94371e87937d7b1b97b5afbe5341e3d21de7b642f0aeb9c270a012386", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170831, "uuid": "1c3e7702-abad-4be0-8542-b982b23f5e76", "value": "T19B534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170831, "uuid": "82f2e0c9-10de-4af4-93db-130707ea0176", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGV8+BCpEMC2/J9KCrMvuBxANUr6FV+tMiwWjIC:MvolWm+phBgd7KCAWBxANee++bWjvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170831, "uuid": "b8f6f613-d0ee-4b07-8673-5cce44274b66", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170831, "uuid": "84b6c851-b848-4bdc-a5cb-a6066dccde10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170831, "uuid": "9a4db4e1-34b0-4ee3-b585-eabd3370db74", "value": "079472cb8f9fcbc696cdb82dddc6f073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5765d2a-ce94-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680137415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137415, "uuid": "3792787b-9195-47c8-9e6f-11b5b5f8c0df", "comment": "Malware payload (RedLineStealer)", "value": "8b52be4221750ba22b73867d77f514a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137415, "uuid": "482462f0-4541-4efd-a3ff-ce1b96cd60ff", "comment": "Malware payload (RedLineStealer)", "value": "30ef240546f3ad9838418737493cf21198054ca9877b6c868ba1919f3d421369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137415, "uuid": "f433c02c-f497-4dc3-b239-26edf2a5e9f4", "comment": "Malware payload (RedLineStealer)", "value": "45b9ed5aa5947e7d7c761a7ee0f9ca04f3d6a425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137415, "uuid": "ec023747-f3b0-48f8-a541-7964f19b1ce3", "comment": "Malware payload (RedLineStealer)", "value": "a3e51973a87cfc70ec04d562324b9695c6151a8239679076cb4f34aa15b11504f25bef6c9812ba1ecc0cc7ea8ad64f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137415, "uuid": "d5660bba-a9aa-4eab-88dc-e4048b4456c2", "value": "T1DD44DF2276D1E4B2E91A057E4812DBB84E3BBC718B15CACB378452BE4E317E19B35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137415, "uuid": "26d94075-b23f-4c2a-b065-9a1f789419ea", "value": "2d2bfb9c54ad9b595d71acc7d26596e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137415, "uuid": "062c8d39-06a5-4513-b23b-8701fe52ab3f", "value": "3072:L3EicBMpyBY8XNhkDhLq+sl1VNqG7rrAEazBEXGuVw6AGoYHKzt48hQ4V:RcBMgNNhk1Lq7AG7HAtuXAGzHKBhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137415, "uuid": "12447ecc-b046-43c4-a730-e487b3eda778", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137415, "uuid": "727ac47b-667d-4212-bb60-13677fadeed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137415, "uuid": "575c0a2f-24ed-4b93-a1ef-2c014f092731", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c0ccf3-cf09-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680187426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187426, "uuid": "8fa99f8b-4677-41d3-87b5-7864935500d6", "comment": "Malware payload (RedLineStealer)", "value": "1e2e7733aaf75f7c772312a24fe7c0ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187426, "uuid": "9537e6ff-0295-4d08-8b24-451f4e862a41", "comment": "Malware payload (RedLineStealer)", "value": "32f02983aee882d0b7a04d1c16db805f24e51b210cb1864d730f22715c60119c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187426, "uuid": "995cd72e-871a-4338-9212-b4b6eb2473e9", "comment": "Malware payload (RedLineStealer)", "value": "aef1291496ddfbca912bbe4e999cf645071053f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187426, "uuid": "042108e1-e4f9-4dcb-ad2d-22c479ef0026", "comment": "Malware payload (RedLineStealer)", "value": "e2738c07d92655260e72d8179862b0cf24fd421bbbccd18480354152cdde0fa2132d2af2760c8bb1b14e614fa3bf1364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187426, "uuid": "e7d7ce73-9d4c-4a8b-80a7-da23b1b7bd9d", "value": "T155B31B5C3B7CDA29E7FE0675B0A0001D13B1E5496946DB869ACCD0692C6BBC1F5C2FB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187426, "uuid": "62420eaf-279b-4c79-93c4-88202892fd0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187426, "uuid": "be93f3d5-2f5e-433b-8b28-6716df87e5a5", "value": "1536:pG6ijoign3Frl4tIioGpnVsK3eZ1/JNnAW/v/CQJu7Gh92f8AgqZ09U1ZyXRUw05:zMnofxN/va4u6h8f8AgqZ0Oby4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680187426, "uuid": "f644a521-72ab-4599-895a-ff10a9f699a4", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680187426, "uuid": "4a7b85b9-1eb3-48d2-a985-6c2b89b81401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187426, "uuid": "dd3f18b1-8091-4fee-9c03-0d92f72dea7e", "value": "last.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c50830-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680180633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180633, "uuid": "a018ce22-256a-416d-bb3a-616234f0673b", "comment": "Malware payload (SnakeKeylogger)", "value": "477a239183f871dde9c079c795fcb877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180633, "uuid": "775f4ad3-c2d0-4889-b0fe-38bb7c37e3fb", "comment": "Malware payload (SnakeKeylogger)", "value": "32fd2dac1d47e4cbfd906b272e933bb347ef2c8abf2cd8695bcfe4e5fecb3bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180633, "uuid": "bb4e20f6-af84-4559-8845-dd99e8523e0e", "comment": "Malware payload (SnakeKeylogger)", "value": "4b5128b15de6de1c45d88be8e153574d6c64f17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180633, "uuid": "bd29973e-029e-4bb9-8d11-7bf92c481020", "comment": "Malware payload (SnakeKeylogger)", "value": "656f57263f9e932858e392492f72808802d78efbfaba9de09a7598fec089cde9cc904fd317020665469d9261006bd82a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180633, "uuid": "9f7c07ce-a3c7-4792-91d3-fda5253814f0", "value": "T129D4024CBAF97433FAB947B6099203505B311219A236DBEECC94B4C43DA27C5E6F065B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180633, "uuid": "94047d48-9667-44bc-b961-4aa2b3671b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180633, "uuid": "abf313f2-f638-4fa6-9beb-80efb0b24e47", "value": "12288:VAAGUowG0HmGR6qMdzEC0nRMgV5HRPgLHyGvef3Sz8kW6AziuJLB:V1GqHmcIz/ibgNef3SFWtziu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180633, "uuid": "a673aacf-3ae9-43f2-a7b1-8b759b732c88", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180633, "uuid": "c366d573-01be-4585-8d03-dd91ab40e1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180633, "uuid": "bd06a181-e2a9-4c41-9266-2a956ceb7671", "value": "Inquiry NO 012594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46749ab3-cedb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680167669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167669, "uuid": "e610caa5-ba35-4d57-af9a-d80afa8a6e02", "comment": "Malware payload (Formbook)", "value": "f797d401ebec1a930a4d693555248172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167669, "uuid": "5b56d7d5-1bad-4e6e-95a0-39a96dc5c707", "comment": "Malware payload (Formbook)", "value": "33abda782a22d239f39cae594050c7cd9ee4506549f2555f88624c5e887abeb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167669, "uuid": "353fa80b-5aa1-49e9-acce-b54d138b0f5c", "comment": "Malware payload (Formbook)", "value": "0c5c25c4cd3b46d67c20cb8973cf2785c5f0c515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167669, "uuid": "34a8a31e-13a9-46d5-bf5b-20ec5d99daea", "comment": "Malware payload (Formbook)", "value": "5ff4648ffd0ecd76ab60af010282075c356ae42077e523d1cd3406af897e97f44d4fcc298c36579b2f590dfd985f8e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167669, "uuid": "a7a68e77-f442-4c6b-a044-a44a1f175b05", "value": "T10144120076E2D99EFBA70FB009799E629FB9E922296847CF13109F4C7C27591E40E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167669, "uuid": "dc9aaa41-a5cd-45e6-a6e3-3e15ba63cee5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167669, "uuid": "8c894793-48b2-49d8-870a-38746fcd4cd7", "value": "6144:/Ya6KLDNoSTCbekoJ8mXCwq86DVHne4q342:/YsLDNo39o2mXen8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167669, "uuid": "91d6aed7-b885-452f-8034-0ed4e14bc70e", "value": 254961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167669, "uuid": "9ca09f5c-8ea6-4c9e-ad25-0604ceb18969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167669, "uuid": "9d4ca4f6-8934-426c-ad0a-81852fc0abb7", "value": "ORDER INQUIRY_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a59ce5c-cec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680157824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157824, "uuid": "f63637c9-5aa8-4698-9346-e12bf485cf4d", "comment": "Malware payload (RedLineStealer)", "value": "73b1586d7d158fac313a4a5d33545331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157824, "uuid": "23d65d86-0afc-467a-9827-ae2fd5a15ebb", "comment": "Malware payload (RedLineStealer)", "value": "33f3f1a57e1ee2becc54dcc7a95ab4ca9c522f38eae8d892f3c4f8ae2cea0960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157824, "uuid": "f8ab291d-754f-4111-9eca-5acf512124a2", "comment": "Malware payload (RedLineStealer)", "value": "271cfbd84fb53e27aaff5e122efac2e8dcd7d93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157824, "uuid": "416baf1e-06e0-4ed6-980c-84767d654b45", "comment": "Malware payload (RedLineStealer)", "value": "5c443974e076eb605b91fd12c7e8ae05262c5d1d698641a7556d6e73e1eb1803a696f3a9173c7e8c48a4150c9051da11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157824, "uuid": "fff98667-f948-4dba-bcc9-2aa1e11f97e1", "value": "T19F252357A7E98473E5B59BB03CF203D309B57EB20D76A77B27488A161CB3A80553132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157824, "uuid": "0bd042d9-849d-4ae6-945d-6c4c3dd0ea59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157824, "uuid": "3392e403-4fcd-46d4-b38f-4ccc5279e0c5", "value": "24576:Iy9436rh+61VCNOZQEZF3Yy6cR1wcOkPUwme:P94q1/CNpELobcw5gUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157824, "uuid": "1fb9f318-f377-4706-aedd-3c6adc7e5099", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157824, "uuid": "ab11647a-67f9-41d0-9072-4d2981e35b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157824, "uuid": "a0320dba-bfc8-4d56-ab22-3f401cedbc71", "value": "73b1586d7d158fac313a4a5d33545331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce2a864-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219219, "uuid": "5fc82563-01fd-4499-a646-4507731827ca", "comment": "Malware payload (ZLoader)", "value": "cddadcb2f1e8be946577e547d4b2f511", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219219, "uuid": "cd40c01c-449a-4768-ae1d-42b3440fd0ba", "comment": "Malware payload (ZLoader)", "value": "346566a4153a1a31a509ebec84a81e0b1659353771ef48801ae6b86afd895da3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219219, "uuid": "c64e08a9-6716-4072-af71-8e9e56419d16", "comment": "Malware payload (ZLoader)", "value": "f9db1e42a3a3e35076a371de508136ed167f6ee1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219219, "uuid": "b9c1a037-c512-4d91-bb60-bb337a07aab2", "comment": "Malware payload (ZLoader)", "value": "bfcc422b7243dae524dd525466ea80da31d8e1b14cdf0e0600bf4f4fa7f560998e687139caf14f63d60442d2077abee1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219219, "uuid": "a0245eac-8c86-47ee-a354-a77f3121e313", "value": "T1F7F262E7FB85ED66CE588339486B42A06712EC515B6B838B3385F72A3F71BE04902147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219219, "uuid": "f470017d-bdae-46e2-b62d-5ac58bd6d82e", "value": "768:PPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJus2acPTost9H:nok3hbdlylKsgqopeJBWhZFGkE+cL2N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219219, "uuid": "d506c568-ef88-4dfd-8e05-1355c5161b49", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219219, "uuid": "ec439e03-83ba-45f5-8b18-ba9c6ad2f73d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219219, "uuid": "7c2564e6-00ca-405b-b468-c60582082fce", "value": "SecuriteInfo.com.XF.AShadow.1205.10577.18568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52181a3c-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219228, "uuid": "2aa9882f-81b1-4e05-ada9-15378b7c0c4f", "comment": "Malware payload (ZLoader)", "value": "623320e71aeb5208d72fa2e0bd074f21", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219228, "uuid": "a148e8bb-828d-48c9-9cc8-dab269e9c521", "comment": "Malware payload (ZLoader)", "value": "34683184956ac22bf8dbc9d3b8cc77961029956ad83b94b10c7d25fc1382dcd8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219228, "uuid": "b57efef5-4feb-4365-be28-b5f4cc3525a4", "comment": "Malware payload (ZLoader)", "value": "edb0a1f429c923abb7eb9c7e254c74fcd31f2585", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219228, "uuid": "8dd83043-a9dc-4eda-9973-d45ed04c949b", "comment": "Malware payload (ZLoader)", "value": "300a9e15b9c9f0b9e1371fb9f0ffc9858ce4d46f446240f10b33a568c86ab15711ab4e34fed3a9eeffd1eff92fb114bb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219228, "uuid": "43fe7249-c56c-454e-94a7-6dc9da521ce4", "value": "T173F262E3BB96ED65CA484375486B43A0A713FC51176B83873385F7253FB5BA08E02687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219228, "uuid": "f0028604-3ee5-4ce3-ae99-09d47c8280b9", "value": "768:+PqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsU2+PA5I0s5Y:Cok3hbdlylKsgqopeJBWhZFGkE+cL2Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219228, "uuid": "81acb343-907f-4e39-90ca-43cd9ff764ec", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219228, "uuid": "37528d6b-d2f7-4e13-802b-ff2638eb9d76", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219228, "uuid": "974a06f1-24f5-4c50-89da-4ac56616e201", "value": "SecuriteInfo.com.XF.AShadow.1205.19070.1053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36de41f9-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680184823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184823, "uuid": "c0f758ad-cb67-47a3-ac38-b1bba77ceccd", "comment": "Malware payload (AgentTesla)", "value": "7d3508bd9e84fd7e358e01241b321408", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184823, "uuid": "9b4cfba4-7fb4-49e4-883c-e37a5983119f", "comment": "Malware payload (AgentTesla)", "value": "34f112ec32f6f931684512c485086cbf86ee220affee14cceb669c82ccc84d21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184823, "uuid": "69c445f5-327a-4c53-b96a-4a2e4b3eff57", "comment": "Malware payload (AgentTesla)", "value": "dacbf7123b7e849c510e4d324332dfd4d72205f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184823, "uuid": "d5f9786b-47d4-4040-9b65-b3a5537fa095", "comment": "Malware payload (AgentTesla)", "value": "2f4b8a53244e65dfacd73153b2f0429c064a02090126c445b32f7bb45c6fd1916a12d50c2e305f366a226c475a8b8017", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184823, "uuid": "cdab30e0-c2e8-4c6b-a50b-66e507eba3ab", "value": "T168E3905433D90AD2E17DFAB4AEB13210447ABD6919E7DE0D0C0638990DF9BC16473BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184823, "uuid": "503ac2f6-bb73-455a-ba32-336ba8cd12c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184823, "uuid": "987e87ea-66c6-4e1e-bdad-66ed3c18c3ec", "value": "1536:d+IjIjudOc3Yp12R6lx/N7Wi10GdEnOsl60:VjCMUuYBN7WK0G6fl60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680184823, "uuid": "2b2165c4-8cb3-42b0-9ca2-67ccbb96c8f8", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680184823, "uuid": "4139832a-ab04-4895-bbc5-860f6f1e8238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184823, "uuid": "bbc403ff-e870-4afe-95a4-a50821c8990c", "value": "New Order ESK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000e1b3b-cf24-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680198904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198904, "uuid": "7dfa6847-99dd-4fbc-8fc2-fb11ccd21bd5", "comment": "Malware payload (SnakeKeylogger)", "value": "f19c34054199717dac72c386ddddd0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198904, "uuid": "1f50b08f-aa36-44a0-9e94-103b6824ba22", "comment": "Malware payload (SnakeKeylogger)", "value": "351c8d8b35c127e116e63eae43fb4aa24ceec9d4ca93f67e1b94dc7d271f205a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198904, "uuid": "80edd46a-136b-4fb8-8998-e1216d788844", "comment": "Malware payload (SnakeKeylogger)", "value": "f198077ba4ee5c000bfdb43b340b0910001d8939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198904, "uuid": "e98edcc4-7b95-40df-9806-ffff33e90105", "comment": "Malware payload (SnakeKeylogger)", "value": "34f99a7bb1a7718aa15856e6a5c3c1c4163f4a3d997e0174d8b579e5205cb20ccfc83aa55c2c688892eb04ddd17c676e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198904, "uuid": "cdcd3951-8223-42f3-843a-fd063cb58220", "value": "T190D4011536E98A0DC12697BE81E4D1F063B5CCD8E2A2C7234FD9BDD3B3CB3865521096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198904, "uuid": "8a2e4743-61bb-4b19-a0a3-72eedbe7d46e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198904, "uuid": "bd1f95c5-933a-4a98-953d-590e9352caa2", "value": "12288:2dMQ0TbAYnB3J7cHgE1UUrMYPW/Cve/FucofQUimOMt+:27IbAYnBpcHd1Um1PXmtu75imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198904, "uuid": "0f89d6c2-3683-4264-952f-a63dbcd599ea", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198904, "uuid": "e6f7c564-81bc-48f4-a284-ff66a8559f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198904, "uuid": "5f019040-dbf3-4a5b-9da3-7552a6930c73", "value": "f19c34054199717dac72c386ddddd0a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d3f868-ce97-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680138496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138496, "uuid": "998f5c18-25f8-44d4-889a-dbc9044fba15", "comment": "Malware payload (QuasarRAT)", "value": "00535440a40587b5b08ba0b98dfeb4b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138496, "uuid": "ae2bd3c8-3399-4071-973f-b6d0ceda14ac", "comment": "Malware payload (QuasarRAT)", "value": "3641770670faf667b289df978513c46c31b2074cd5504cbd73dccc510e394ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138496, "uuid": "d92697c9-db49-4f53-b40c-b47e4326bd55", "comment": "Malware payload (QuasarRAT)", "value": "7ca280a1dc7102c3f371b748b8e9b6a13cf09b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138496, "uuid": "e34dd3a7-a1ad-49aa-b160-162d4269ef51", "comment": "Malware payload (QuasarRAT)", "value": "a9f53cdd88d0580182829496907566f9605c772f28d5e7ea31cada0652a689d454cf30a86269ca4f4d1d2fd25e4eea1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138496, "uuid": "cd3389ea-9082-4d44-9c6c-0212d16ccbe3", "value": "T1AAE55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138496, "uuid": "d380a79c-1bb6-437e-a04e-496732c8fc95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138496, "uuid": "800bdb42-4bed-4e23-a9cd-b55e23361970", "value": "49152:DvCI22SsaNYfdPBldt698dBcjHqxDE/Avk/JxPoGdIfhTHHB72eh2NT:DvP22SsaNYfdPBldt6+dBcjHqxQNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680138496, "uuid": "989b0d85-e94c-403f-b374-fac38f679465", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680138496, "uuid": "af2cf29f-d6b4-439c-8457-d77dff5df46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138496, "uuid": "e636dfbe-341f-4b62-9b0a-709d263399ba", "value": "Orcuido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5179b4c-ce92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680136582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136582, "uuid": "a42e0612-2cc4-437c-ad59-434b9d450b7a", "comment": "Malware payload (Amadey)", "value": "6d2fc025ca0dc64111c1ad6af9d0b702", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136582, "uuid": "6f9916c2-813e-4de9-93fd-fd436ef743c7", "comment": "Malware payload (Amadey)", "value": "366480fb04924f0524be9bb5bf0ba55cbafe9753e19dffe69aca6dbcdf3e1f24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136582, "uuid": "cfc711a6-c7b2-44b1-bcdc-22fbd16166d2", "comment": "Malware payload (Amadey)", "value": "8bcf84dfd2fe9b064b3ea46a8f1b9b9bb508b167", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136582, "uuid": "7318677a-27a6-429b-b0ed-0c7c3237c471", "comment": "Malware payload (Amadey)", "value": "1703ec2ea924af94a71f3d59437db74a8213b4cdb3de97c103814d758ab0c3217bb2d2f799806ae05b159b7b514c105d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136582, "uuid": "cd396cba-ba34-4b57-88fe-441215fb2ba5", "value": "T13644C012F692C47AD95B057D4901EFF85E3AB8715B2586CB2B801ABE4E307D38F3534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136582, "uuid": "9a0dad4e-492f-454b-825a-b8b905fbc50b", "value": "382fb326b0589506daf25ca040a05448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136582, "uuid": "3ad4b7bc-e5bd-4bc8-98ea-87125b700ec6", "value": "6144:uwJj5Wp/5Mg6LWrUFZOLLUOZIWrb9SCTi6D:9j5s/5Mg6arUFZO1zb9Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136582, "uuid": "1bdd292d-343c-45ea-8646-b02cf521f01b", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136582, "uuid": "443a7d68-0a5c-4cf8-987e-7fa06e59226d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136582, "uuid": "074b086c-6abf-4420-9444-eac5f91f342b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6072a006-ceda-11ed-88f6-42010a9c006e", "comment": "Malware payload (Grandoreiro)", "timestamp": 1680167283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167283, "uuid": "0b557e57-2261-49d6-b296-ae5816eb3e81", "comment": "Malware payload (Grandoreiro)", "value": "cfdb15ef5c8a1c3c85b10b6846aebd04", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167283, "uuid": "c6deb44d-adb8-41f7-8cd4-c1a74a439acf", "comment": "Malware payload (Grandoreiro)", "value": "3810d9472973ebfc636f39c290dd4ba21aa87beb926aab38b967ae3299518a81", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167283, "uuid": "08ed49b2-c54d-47a7-a05b-4c106477eb17", "comment": "Malware payload (Grandoreiro)", "value": "9c5aa7dab14157310f1a4d8dc403c5f4febc4072", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167283, "uuid": "c93db7ce-458d-4b72-a489-c253a8b7e772", "comment": "Malware payload (Grandoreiro)", "value": "495efa87270ef84058aaa987e1e094f72191f9ff0548702a8e253a89a98ddacb20c78bad49048e3b148ab076e6fffd20", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167283, "uuid": "3d9fb01a-754a-46e2-a638-716d761a8343", "value": "T1F637338312F98D5FD35E9499A75EDE898806ADB1C0CA61AE7EECC8C087F510C3791D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167283, "uuid": "f7d95bbe-f4de-4a1d-960c-ff29f83a25e9", "value": "393216:vUnI+rJ2YNb4wNwNGf/Qw3i2msapFRvqkDMzJg3sdGAmW+9Gt0C1kG2RDQ6kLlcn:vUIeTNEwNwNGQoi2oB2Vusc9kRkG2RDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167283, "uuid": "c918ce6d-30c8-412f-8529-be937e61f97f", "value": 23760795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167283, "uuid": "2cb48676-e43b-48d6-9532-d93b6f400b1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167283, "uuid": "12a9d6bb-4d42-47a6-8e35-969cad34f673", "value": "Test.Zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac6d408-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219189, "uuid": "b687fc64-a6a8-45aa-94c6-a563ab818a91", "comment": "Malware payload (ZLoader)", "value": "379146831e96c4374f3d05db46d978b2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219189, "uuid": "460842ec-698d-4cc7-a219-399bcc4256df", "comment": "Malware payload (ZLoader)", "value": "3a27df27123dfe41e25bfbbabd52dc78fd6a7dd9c569dd4464a60eca621623e1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219189, "uuid": "d6c2eb5c-8f35-4978-875c-1d3909c6cd4a", "comment": "Malware payload (ZLoader)", "value": "9e7d1e8042810ee3b691ee307caed7dd5fd0577d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219189, "uuid": "04047ffd-05c2-4c5b-95b1-be409bea2e0f", "comment": "Malware payload (ZLoader)", "value": "ea5fa5dcecf1840ad66bae4051e62d754afb33e9e7279a6c65c8490cc32910015a186c34ce6c8b16de5a557454c84b7e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219189, "uuid": "df67928a-5806-4549-b098-ba184a4a91df", "value": "T1BAF272F7BA86EC66CE488379086B4390A713FC5157A7838B3345F7263FB1B90590618B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219189, "uuid": "0dfe8658-03cc-4e2d-84e0-a1cba24efe44", "value": "768:TPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ9dfPj5jlinfeoqMi9gZ:Lok3hbdlylKsgqopeJBWhZFGkE+cL2NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219189, "uuid": "b3e53f0a-bf3a-46e2-9a16-b77d916a3724", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219189, "uuid": "88d74e30-e22e-479e-9371-aa2ac84d2da4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219189, "uuid": "0cf22002-3e7b-411c-b0eb-65f58a778af9", "value": "SecuriteInfo.com.XF.AShadow.1205.3053.20328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14979101-ceea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680174028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174028, "uuid": "4b63525c-fc2f-4bcb-9114-8f40332d30aa", "comment": "Malware payload (Amadey)", "value": "40d019f5666bf7aa6f25328eadc4af2f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174028, "uuid": "15cb2dc9-c753-44c6-8fcd-b397d0f3b325", "comment": "Malware payload (Amadey)", "value": "3b775a569137755d821fe4c8f9353c267dc1450aedbf8e9af7ea32802d4a530b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174028, "uuid": "50dd763c-bb0f-43b5-9e78-b8be9f924494", "comment": "Malware payload (Amadey)", "value": "ac9ea13aa12d0ff5636cbd1e21e82cf2ce3ecdea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174028, "uuid": "49e7e2c0-9bdb-4db1-8fa5-4174f407a50d", "comment": "Malware payload (Amadey)", "value": "58adae269f54780527ef95b286d440016fe850d92f2077bc6bc1c963d1213da982280544d9332e2e8664998adb2482a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174028, "uuid": "d3548337-18df-4b51-a331-839671a3c9fc", "value": "T1AE252342FBC855A3CDB11BB268F6079317397E501DB5869B27C7981E2C723C492327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174028, "uuid": "e0770b57-726f-494c-aefe-f01dc412c1a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174028, "uuid": "14b32b4b-0c2d-481f-ab1e-a7c8ebe7337d", "value": "24576:NyFhDUu6QhcP4B+kD152BKoRpjWvFMcN:o/rcP4BD152BK0pyvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680174028, "uuid": "ba28768a-a569-4cea-ad14-4fdffad1675b", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680174028, "uuid": "ed298d27-10bc-458a-ab02-3f2ea971ec64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174028, "uuid": "4f8c1e47-7ede-4fe4-ae2a-5dad709e1e0c", "value": "40d019f5666bf7aa6f25328eadc4af2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b54bd4-cf55-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680219964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219964, "uuid": "383e9361-a7c5-4b7e-afdf-3316d8567f44", "comment": "Malware payload (Mirai)", "value": "e60816ce197dc84f82e9d04ae1937378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219964, "uuid": "924f5765-bbe3-4c44-a0f5-0333af0c02b2", "comment": "Malware payload (Mirai)", "value": "3c7f7b836ea92aa918112a2691228ff47e995038ba364a9e59ed5babfc4425ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219964, "uuid": "f19c45e9-5f15-4960-b000-19ee9beb70ce", "comment": "Malware payload (Mirai)", "value": "9d6c88d75123ee28e7dff48f1f8ac787b5e7469a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219964, "uuid": "623aba54-ac3c-4064-b899-9cda15530e78", "comment": "Malware payload (Mirai)", "value": "1cf558c7a98d3815fe3cc936dbabbb61311191e7968abfff664eb6a0b4a84bfa90b702fbafcc02fe02fd90221a52edb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219964, "uuid": "7df0b53a-a71f-4875-9031-515260cd6d06", "value": "T180B2E1BEF1654E78F650D07325B8C89BA042F79AD58A9A8DD2D19C6728273193133FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219964, "uuid": "d8fcef13-0ef5-4045-a979-29e1aedd6d79", "value": "384:MCcnZ4Dj8/hG15V6qtYI/0FvusRAy7Q1c61ZAEizUeH/eOyG3273yL:W4j8/hGvV6o0kyz7sypH/jm2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219964, "uuid": "3c009ae3-d071-4d46-8461-51bba08fe8da", "value": 23616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219964, "uuid": "18e06766-49a9-4a11-ae15-f6c97a497e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219964, "uuid": "7f547e6c-5921-45b3-b3bf-3d4dd9b65847", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85c8371-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680185120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185120, "uuid": "f5f946e1-d583-4575-bb1d-ec4e7c326cbc", "comment": "Malware payload (SnakeKeylogger)", "value": "20ff1f07155a24c9b7f8b444ea58255f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185120, "uuid": "7de6bbbf-88f9-4fa1-92cf-c3c739cfd2eb", "comment": "Malware payload (SnakeKeylogger)", "value": "3ca1a9ee70e56cd13b3472f4263f9c480d5fa9d70a18335e28ea41b5bb048461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185120, "uuid": "a6827487-b84f-4a9f-904f-8f01187b3b2f", "comment": "Malware payload (SnakeKeylogger)", "value": "7258dbc04af293dc048e9ad6ee4669a89a7f85bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185120, "uuid": "4184f8e5-1f88-4acc-8809-e0292291dccd", "comment": "Malware payload (SnakeKeylogger)", "value": "02be48bf732e117217c68ce9fdf57c868a8d75e0ab2db6a9573705d160ae7c9d5ed793793b5365cf275a34147c43d2fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185120, "uuid": "fc21d01b-825d-4cbf-b363-044f680b4ed5", "value": "T190D4F15436EDC60AD026D77D81E5C2B1A7B6CCCAEA62C7174FCABCD7B28E36600151D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185120, "uuid": "fb39fe7c-b0df-476b-b8b1-940958c234df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185120, "uuid": "ac27d347-2391-458e-b73c-f18e275936e5", "value": "12288:4GM/cQggfXfJndIbSO0kTg8z6N21563LDAjBDhGyYvTav3imOMt+D:4H5ftdSSOxg8z62154Au7av3imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185120, "uuid": "1a4b1eb1-b6aa-4bc0-9256-c2d311d32bf3", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185120, "uuid": "f272ded7-f412-4fdc-878c-147a5186f83a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185120, "uuid": "e6f3e580-545f-4968-a88d-e0e4da4e25af", "value": "3ca1a9ee70e56cd13b3472f4263f9c480d5fa9d70a18335e28ea41b5bb048461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33f3640-cec2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680157087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157087, "uuid": "94097b29-efb0-4d55-9cc1-4226badae2a5", "comment": "Malware payload", "value": "5e3e38e71e155efd12ee76dd8daf28ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157087, "uuid": "e72396f0-7fa1-4ac4-af90-1850764269d2", "comment": "Malware payload", "value": "3cdb8dec83c3eaa9019c826dc80018f3d8b78d926f0a36e812913b962bb2c49d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157087, "uuid": "03284475-3b3c-48e0-ba90-5d1b65930ecf", "comment": "Malware payload", "value": "20e4fd3c32d6616cbc94da69d536557a06954eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157087, "uuid": "e8e1c919-308e-4f43-a11f-9937e6bb617b", "comment": "Malware payload", "value": "8f7e45a2308a389cca27dabac72dfa9bbce47f7887bef90ed4bed55022cea9db8b8ef26b64c0c7524595fe431eb73711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157087, "uuid": "b75d92a7-f1b9-486f-9693-8dacfe0406df", "value": "T159B56BB122A3FDC5E77F1D8480142540EC54696797ACC64CFCC92AAB93E9714EFAC6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157087, "uuid": "500270fb-4c63-4816-b692-174b98d15b2b", "value": "24576:qRRjtXhynlZoOlHKtu1Dze6HDpLVq8Hz10D+LtNVMdMm2NLwASieXLHfMiLiKeXi:yRRXh49+4o5IjafLLioXMLrRRd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157087, "uuid": "821e05c1-99b5-4271-9241-e286ed0aeda7", "value": 2432512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157087, "uuid": "37a55c37-e603-4571-ad29-0a4b9ee7b3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157087, "uuid": "77b70c5b-4918-4daf-a31c-50eea6f0c943", "value": "New Products.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b26d3d-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680161145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161145, "uuid": "67953553-9cda-40b8-8c84-707f25b21ffa", "comment": "Malware payload (RemcosRAT)", "value": "bfe1e1898909322f61ed501ea76a6a8b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161145, "uuid": "1f06348b-bdd8-4fc4-a892-c2a2bb485892", "comment": "Malware payload (RemcosRAT)", "value": "3d1a75579ef0717708782f63318b36e8dc0356fc477370ad9c69feac793a6a95", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161145, "uuid": "3cfdee72-95d6-4f8f-895f-c6bc9c6b4a18", "comment": "Malware payload (RemcosRAT)", "value": "9e57018d24ea330be01c9aec2561a59256f2868a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161145, "uuid": "58f54880-92bf-45d3-96fc-a2f4478f7fc3", "comment": "Malware payload (RemcosRAT)", "value": "a0c55753eb6e2e17bb2a3acccaa40346f625da2b34f57e0c9cce700fd40142ddb727ca45b5f05b822d113b5219269faf", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161145, "uuid": "ff0ead63-1485-4f63-83e6-a2f0f48cf6a9", "value": "T17125126037ECD156C56543BA85E4C3B05339CC88E67ACBA61FC9BDDBB2CE3069121297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161145, "uuid": "255a3094-152a-4ccf-b23d-f98faa55e38a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161145, "uuid": "484288f1-1c63-447b-a8ff-91e0f785fa47", "value": "24576:aHoNbNpojIlnaj6ioCRGHvtq+0Qv2Fj+QhimX:aHQUIloQCKFq+0Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161145, "uuid": "a4cc4c04-60fd-4e76-bd15-25cbb82fee5d", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161145, "uuid": "2f934fba-bea9-4915-ba30-a8422eb7374e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161145, "uuid": "1d12bfc2-3bbb-48f8-918c-5a943705a01d", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395e4eb3-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219187, "uuid": "a01fd1be-ce31-46d0-b512-6df1eb7a40e6", "comment": "Malware payload (ZLoader)", "value": "7a4e8836948c50644f6d4da1e4f0ebd6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219187, "uuid": "ad482a8a-78e0-4856-8178-5360dddbf686", "comment": "Malware payload (ZLoader)", "value": "3daf01eebe957c2b6f087b806d24f03f4ed657d503d61eb17f1b14181fb5a8e2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219187, "uuid": "ffdb8392-6fed-414c-965f-b6a6f82db745", "comment": "Malware payload (ZLoader)", "value": "f68ff24be79b0f5b9f24c15bc65d6ce2149dd5fa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219187, "uuid": "811d5cbf-d471-43fe-99af-c14a27cec0b0", "comment": "Malware payload (ZLoader)", "value": "25413353c81c7d840008ee5fa13e927d0c3beaeb8ccc06ff2368738e704acadfc395aceee258ff90b881531b6376ffd7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219187, "uuid": "bfa05b11-8022-4c04-938a-862927f73531", "value": "T163F273E3BAD5DC65CE48433548674790A712FC9157AB938B3349FB3A3FB1BE05902286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219187, "uuid": "4bc87ba2-4560-4618-aa85-7dc05fb8d621", "value": "768:+PqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJZip9z9gmhoXgk61Z/95:Cok3hbdlylKsgqopeJBWhZFGkE+cL2Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219187, "uuid": "f1f60551-dec5-4a5e-8bf7-f4261fdd711a", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219187, "uuid": "cb96dce7-3f33-4e68-bae1-84db50d5b570", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219187, "uuid": "b937d5ad-c761-4531-b95c-07d52ee1ac76", "value": "SecuriteInfo.com.XF.AShadow.1000.1879.868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d098b1e4-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180786, "uuid": "dfbcaf1a-2e7d-412a-ae24-a12e91c4fbdd", "comment": "Malware payload (AgentTesla)", "value": "db36641ec3f10d09764c30c7b5b878f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180786, "uuid": "17936400-48e0-4614-86d7-9896d5221a94", "comment": "Malware payload (AgentTesla)", "value": "3dc8800e380890fec915d4f62026caf4c5ff66f409d1c305c27b5f0ea14834b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180786, "uuid": "320e18a9-385e-426b-9d57-e3157df6d235", "comment": "Malware payload (AgentTesla)", "value": "0a743acaa85fa32457e6a84dfc1dbab53cd07495", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180786, "uuid": "d49da620-e441-4564-96c1-9efc7e4f778c", "comment": "Malware payload (AgentTesla)", "value": "8c1cc7a2763d90cdc10ba055de7270afaf0727c3ac4518b2f56f76806a351bf4812a330ba31c307b276da6f9e1b9a2d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180786, "uuid": "49a3d760-6739-402e-8edd-1ef2258f7599", "value": "T1FDF25E1AE78E02B48F810277671B1AC896BDB23EB35155B1386C933433EDC2D42766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180786, "uuid": "aee11b8e-6a78-4b43-9770-cc81ead65672", "value": "768:dFx0XaIsnPRIa4fwJMg22OkhBOPYDpJoz741N7ajuEzuDnv:df0Xvx3EM/nk7aYDpJoz0TE8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180786, "uuid": "dcdd7e7d-a2d5-4fc2-bb7b-7ec32620487b", "value": 34704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180786, "uuid": "549acc83-ca59-4bbe-aaa8-914ff33d5fe8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180786, "uuid": "c73dec04-a8b7-44e1-90cf-d28a8b543014", "value": "newXspainXorder.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb89439-cf13-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680191651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191651, "uuid": "d9dd9564-7d96-4c04-83b6-1bdf7d1e26e6", "comment": "Malware payload (Guildma)", "value": "90a87ea85b16b28bc516f2f53cd40f17", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191651, "uuid": "91ba6cda-99af-400f-8c32-83c470b4cf68", "comment": "Malware payload (Guildma)", "value": "3ee8d8db114b2aa4aa270932c0a6a0d54f5a18742ab722553a0c13f43b56b21c", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191651, "uuid": "356b229a-cbf9-4f1b-bd74-ae11b49c797d", "comment": "Malware payload (Guildma)", "value": "438d02decbdddbe7f703914a412f6be734013098", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191651, "uuid": "656c7222-870c-40fe-9a05-602160e999c0", "comment": "Malware payload (Guildma)", "value": "434588da622da6495ade3ed267a1d86db8ac8c73e5eb17669eadc2351b6c5d581eca067c3b48fa6a4e3411294f9c4deb", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191651, "uuid": "949463b8-1119-481c-948f-b36a48298329", "value": "T12AF0AB4DE3613E80D699033B4D5913100F88B95B4B101092A36D0A64A76248DAE0D2B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191651, "uuid": "e54a1723-f26a-4a33-ba54-099f256293e6", "value": "12:8rflM8OBE6ZGZgkD1kTmjd0bLvOm6zm7x2fINGp9TchS:8loGZFDhibLvORzm7MmCiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680191651, "uuid": "64511934-6628-4f28-815c-56c26a24abf5", "value": 489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680191651, "uuid": "04697164-2d1a-4f76-8ca1-478f5ef8d3fa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191651, "uuid": "caf7b64f-a219-4bd7-9f2a-74748b02020f", "value": "Documento_Recebido_2023132.055349.01706.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3fbfe2-ced6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680165697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165697, "uuid": "481ac8e7-4c86-4faa-adf1-04297e999157", "comment": "Malware payload", "value": "3122b42b105273901d3344db1150fca9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LDR4", "colour": "#94408A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165697, "uuid": "6a95ea2f-5351-48f3-9818-ccaccba30225", "comment": "Malware payload", "value": "3f39755d0032320ec50c9cc941ddbb91f1c251fffa2b2df9a287e264a159aa3e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LDR4", "colour": "#94408A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165697, "uuid": "643ce08a-c7be-424f-b556-378949fcb26d", "comment": "Malware payload", "value": "97835b620db2cece9247a610d6118c4582f65319", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LDR4", "colour": "#94408A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165697, "uuid": "bf6247f5-45a0-4955-b909-9156c81e973d", "comment": "Malware payload", "value": "6ea07553c5e4e0fb034c13a43a51e4bbea58428bb5238bfe90d683fd88216bf953c4cf10abcf229f854b589a025e23a7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "LDR4", "colour": "#94408A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165697, "uuid": "7acade41-21a0-464c-b7c7-be8651f2c175", "value": "T124F09E92BF56C2ADA6A4616471707D4CD5120E0FE4107CC942F9D00685166D6AF6DC62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165697, "uuid": "4e1b89f7-9f76-48f1-827c-677f9e467b2b", "value": "12:pLVPOQku+XzLg5dF598uQLiHG4bLiHGBJ0ilzpUjfP0MZz2Ib:vP3ku+XzLgfFkutHG5HG/l2fP0eqIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165697, "uuid": "ad621672-57b5-4ddd-819e-d05014080ea7", "value": 483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165697, "uuid": "b2010fee-cb9d-4197-90fc-96f49b9c85d5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165697, "uuid": "54b9496e-adf2-4aa2-b31d-8244ba748503", "value": "e.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c50a170-cede-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680168913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168913, "uuid": "4170f031-d028-4335-9a22-98df49db9d6e", "comment": "Malware payload", "value": "26ab0d5e4a745d89e9e2c75919bbf7e7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168913, "uuid": "13c46f0e-560c-486f-ac91-ea6524cdce5b", "comment": "Malware payload", "value": "3f45936c54aa5e36d7b4bc6482ea1fd8c8d902f5cf589e8a14d252e3f70fca17", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168913, "uuid": "daf47706-67c8-4ef3-8490-5e1b290c832e", "comment": "Malware payload", "value": "dad77fa11bea021c82fe762078fd3018fdc95a89", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168913, "uuid": "82a1f432-7253-4970-9d48-91f4cb18f4aa", "comment": "Malware payload", "value": "1aadfcee48903e480016228495376e1abba257ade6139a69e76f0c859978ef30a50343d12a01881f8898f0515747de9f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168913, "uuid": "9e243e4a-1ab6-4913-9d00-abb93ab0bdb3", "value": "T15B629DCD90EA61BED38E1A719C003E449B7D3F51621B67C12AFCD22CA0BE55E0E5D946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168913, "uuid": "fb06a570-6eb4-467e-a750-1c92eefa6524", "value": "384:BN1Vlsy7+vbvkQzAciHNPwJ42ZxkJWCGuflBLu:BNey7+vbvkQzA1t4i2ZyJ6u9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168913, "uuid": "b999ae86-ca5c-4b8e-a505-390963946e6b", "value": 15114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168913, "uuid": "7434c0b0-d03c-4187-9759-6fc0b6f7023e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168913, "uuid": "de912d56-cf74-4a4a-9482-abfad8a4a9a9", "value": "RFQ 0323#7461.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7f8955-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680170682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170682, "uuid": "86ce8d47-6803-4a77-b7ec-a8e588e6f316", "comment": "Malware payload (RemcosRAT)", "value": "261b190ae596593e2c77c64d170d7d76", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170682, "uuid": "d3dbe807-13e8-451b-bb2c-c974a01174bc", "comment": "Malware payload (RemcosRAT)", "value": "3fadc8328d153710ca24a8122faa0870b56c1884d55526491364a9b0344f0ba9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170682, "uuid": "cc2c9fae-1890-4797-9d8f-73bd12f4a06b", "comment": "Malware payload (RemcosRAT)", "value": "12a78764918fc40baa8e70ef4cfbf562c38fd74b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170682, "uuid": "ed5491eb-b467-4080-bef6-a3095ee97e04", "comment": "Malware payload (RemcosRAT)", "value": "f3e9c952f8c6459417f8871342cf78b62bbd6c2124f807cced103873edcda25b238ad7d9aa71755ace88c39cd30f1fa2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170682, "uuid": "3848e2c8-613e-4313-89b7-e8e0cef6970e", "value": "T1FCE4239D6ED5A11FFA815A5B18382CB60BD08109EC51681BF2F4F0E9399B3D7296F01B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170682, "uuid": "4fec37cc-05a7-4831-999c-eb015dc3a8f3", "value": "12288:6nUlHtQ3ckvNw4CQvaIBXQ9jteNJTtQhuL0JCCrU4Sot8cALRRxkwqSzqPBWl9sT:KUXvkGOaIF+cdQhuL04DdbcBWlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170682, "uuid": "4bd9341e-9869-4757-82a2-e301d0762a39", "value": 658557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170682, "uuid": "522c4963-536d-4fbd-bd92-04c2ed1099eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170682, "uuid": "5327bfe6-cabc-4587-80e6-109c3c8dd5da", "value": "261b190ae596593e2c77c64d170d7d76.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cc8b22-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680185123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185123, "uuid": "23e03e4a-9043-49bd-a2ad-b27e7b739246", "comment": "Malware payload (AgentTesla)", "value": "e793f299a066e0ad088a6369f3c18c6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185123, "uuid": "9b936c4c-4222-4ba9-8a20-19a25982716c", "comment": "Malware payload (AgentTesla)", "value": "3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185123, "uuid": "1208f698-2a4f-4fb4-bb9e-ea26620290cc", "comment": "Malware payload (AgentTesla)", "value": "6a0ee684e49cda54351f8f737bbd7fa33a9af14d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185123, "uuid": "ba794f15-5f2f-4103-89c2-452ef0d2f012", "comment": "Malware payload (AgentTesla)", "value": "436c19539e24f60a43c0b7c19b19a19b485bf6c679fd743bd19c1c2eaf93960c83957e952c810cbe0fc0e16f03b3ef41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185123, "uuid": "bc4c7679-d711-47ab-a86b-8440698ecfdf", "value": "T141E4F12436EDC206C52AC33D91E5C2B063BACDC4E666C7134FCABC87B3CE7865965196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185123, "uuid": "ba61eee9-b6f7-419d-96f1-563a511fc98e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185123, "uuid": "b146a70a-c266-4fd5-8294-d81af2fb0e20", "value": "12288:xK8/Pe5BdKVfxaaQ5k8eavxQo8yBF9gp5wdnq1J4edrDJlkyDLS2+Z0S1pOJNaiU:xjW5/k+kX66ov3pIDvl/u1p2aimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185123, "uuid": "ad99d33e-f4af-48e4-83cd-9cf33e0e7143", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185123, "uuid": "a2eabf3b-e0ca-4551-a75b-59a6398e727f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185123, "uuid": "a65f80b1-71e8-4c80-90ce-dd5c08a67d52", "value": "3fae62e5822434bb1d7ec5583521a3f08e43a2521e0df922dde8ad18e666bac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bc3fee-ce93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680136714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136714, "uuid": "b15a1af0-d584-4464-8235-0840d3d3eede", "comment": "Malware payload (Smoke Loader)", "value": "7948d1f633e3d5afb58d1e0048fb18e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136714, "uuid": "e6fa389e-d6c5-40b6-8ec0-04a8516fb7a1", "comment": "Malware payload (Smoke Loader)", "value": "3ff11af6e5f608e84a48bc486de1403e63f6e76f64c6b5d425e5f94f2c59fcdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136714, "uuid": "5e769cdf-6d02-44a2-a674-caa4f9616f6e", "comment": "Malware payload (Smoke Loader)", "value": "9ac0338d6bb8bc259c073b78134ea132c695071f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136714, "uuid": "a13722f3-2f18-4fb3-b804-11acd68b7e42", "comment": "Malware payload (Smoke Loader)", "value": "1042a8660c2a845021d1b60465c7cc924cc8728de3c37c8e1c1b08d2270b0c64275a09e43acfc854ea9aa66ac743ca53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136714, "uuid": "a7b79292-0057-4771-a498-b30f5e787477", "value": "T11C44C0223792D4B2E91F057A4811DAB85EFBBC314B2586CB375406BE4E317D2CB7634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136714, "uuid": "673aad2c-d0ca-4f92-865b-c48ec1e26375", "value": "2222fbb8197512ba6814617787ba14f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136714, "uuid": "2dde457c-b689-47dc-81ba-e3ade37dc41c", "value": "6144:GNjCAHt8e9VPDLjWP+1HBiuYBsnedi0huJz:qCAN8e9VPDXWGaLan4i0hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136714, "uuid": "36e1ba9f-6041-4d11-a5ba-79b672ea5595", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136714, "uuid": "310e9192-9636-4a5f-8b27-d9068d65e716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136714, "uuid": "2e79e581-adfe-467e-9f53-b733759e780c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dbbb3d-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680161459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161459, "uuid": "cd00cb12-7571-4690-80d4-7cc330acbe0f", "comment": "Malware payload (Rhadamanthys)", "value": "497cfa2431d03c06f6a60fa55d587dbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161459, "uuid": "29dfa7d3-f5c2-4582-8d69-0e4661fe7588", "comment": "Malware payload (Rhadamanthys)", "value": "4099b352c15d6191c8d98a823c9b95b58baa2bc1c308f06e6697562cd21c339f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161459, "uuid": "372635c0-bef3-4e20-8fec-8967a5f8ff7a", "comment": "Malware payload (Rhadamanthys)", "value": "0b572da520699d7514b0f18edd20cd2d06d03238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161459, "uuid": "e94ee59d-8a2e-46b6-889d-729459bf5875", "comment": "Malware payload (Rhadamanthys)", "value": "046260b5907a56a74b4ce97c2b31b8e4746823bacbdeb648d688cd288ac3e7706f4722dcab3942785da5a2af32616dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161459, "uuid": "96cd765c-e022-447e-94d3-351eb5ee8597", "value": "T1A164E022B7D1C071EB0A45784911DA749ABFB8745FA38BCB3B8C167E4E313D18A39356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161459, "uuid": "5ae510e3-96a5-4dc6-9a54-8bb1c2e770c9", "value": "fde2d3c5c6b5080c428e56f6f2289988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161459, "uuid": "19a9886d-d9b1-4b5f-becd-1f7c17d19567", "value": "6144:REolVJf1L+w2BSMz/rVAEG06a+ZYpxkS:RXVJdSw2oMz/Onr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161459, "uuid": "333d2cca-17b4-4861-8d52-a890f74c0814", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161459, "uuid": "68ef0d82-cac3-43cb-a076-d3287b7f11d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161459, "uuid": "b8ad5356-d6d7-4a86-8ffe-ab2eb869cf5b", "value": "497cfa2431d03c06f6a60fa55d587dbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92044dac-cf05-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680185834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185834, "uuid": "40ee8bb2-e470-459b-bc2e-715f789c1b4b", "comment": "Malware payload (AsyncRAT)", "value": "b73b7366b221f47cd8bf32f1ddd249c7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185834, "uuid": "dce88829-8928-4570-8081-d50492686f03", "comment": "Malware payload (AsyncRAT)", "value": "4234d761efcdd80039adbd4a6ecc1e92acaa62ab857f9385703565791ef2c396", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185834, "uuid": "f2363102-e9f1-4253-b0e3-6788f212eddd", "comment": "Malware payload (AsyncRAT)", "value": "ac7b79b0f7d155d97f5f2169a75e178b17b45a8c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185834, "uuid": "b30b72d6-cadb-4ac7-8f76-ca6674794b46", "comment": "Malware payload (AsyncRAT)", "value": "84926497d853cd2d9d8e85e43d98b8eda02dd72881b79f25d2be7426a0d92e047b444d16d32a0daa8cf0ed1ebd74c60b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185834, "uuid": "19501a1f-df60-49ec-984f-8913ef81d414", "value": "T164C5120873D69F65D3BE077CE0A0D332A775AC169297C39B29C40CAB3892785DA41BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185834, "uuid": "59837929-25f2-4f39-8f17-ab601071196b", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185834, "uuid": "608514fe-00e4-4d2b-8b13-2536aae9f766", "value": "49152:1mpBwKqVvJxXBPYgGW8qJDArG8d4Sm+t2MSldyeHVD7mnw6l3LJQAZnV:1kwXJxXBhdArHd4RdNh7WllQABV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185834, "uuid": "0c477fdf-1bcf-4440-818b-eba18e7db953", "value": 2742272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185834, "uuid": "3d5e920f-f0c7-404d-98f5-3e5b3c3311c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185834, "uuid": "47e19d08-0da9-480f-af42-e625b9baf1b5", "value": "4234d761efcdd80039adbd4a6ecc1e92acaa62ab857f9385703565791ef2c396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d33b20-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680198330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198330, "uuid": "24eb73e5-8ed5-4fd1-bf4a-ec10526f9d04", "comment": "Malware payload (Formbook)", "value": "60cb0c27a4ed87c545725d9bfbb7ba18", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198330, "uuid": "6fe6d855-d44e-425d-bf2d-985b5b189db5", "comment": "Malware payload (Formbook)", "value": "42375ef6316e9b60df4c237e7a1defac0c72c5e7c0bcf46ffebe646c0efaf1d3", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198330, "uuid": "8c9ea0cb-a6fe-42f6-965f-ae1e038a7fbb", "comment": "Malware payload (Formbook)", "value": "9c107099a47b23b949e7f68eedb8e86047ebe212", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198330, "uuid": "a0f989b0-29bb-40a1-9419-2a20aa138345", "comment": "Malware payload (Formbook)", "value": "4a5421107a9c96af1700fd5bd745d13dfe7fe4aaeb0de3134acc6a24ae3951bcadf36a184846d1bd28c137cea11ed1b6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198330, "uuid": "54460e66-4f26-4584-8f41-ed6a2f795cc1", "value": "T14C741201F7D88846CCAEAF7164DBCA354A30F918A443E3FE7295B15809E23D859E93D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198330, "uuid": "25d65d5c-8ab9-416a-83af-1a8931c6db4c", "value": "6144:Pg+4KojJbjMg9B6aWebM4cDDatmb0vIEPXhLxupI:POKojJt62oWdvIEPR9yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198330, "uuid": "7a222afb-b398-49f0-8db9-a92f3122a848", "value": 348392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198330, "uuid": "d25af381-9ea8-48fb-bb89-d6ba9dc37298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198330, "uuid": "e266bbcd-65df-4ee9-af3d-bc44cace21db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec9b9d6-ceeb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680174662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174662, "uuid": "eea3ba78-c91c-4397-8839-c6eb5c34fdc0", "comment": "Malware payload (AgentTesla)", "value": "293c05d66a76bfcb888efb06a62a28a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174662, "uuid": "0612c373-762e-4cbd-83c7-00c0428feda2", "comment": "Malware payload (AgentTesla)", "value": "4241d1aa7d78cac68f1c04600bbf4eabe31e6dc3dafc493657a8ae1197939dd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174662, "uuid": "38ecae70-31f0-493e-a446-a1fa39aab3fa", "comment": "Malware payload (AgentTesla)", "value": "b9a33b0d03ad536eb3a2a2b3ad580c76f9d61725", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174662, "uuid": "71c6185b-89ac-476a-81df-37b32776f8a9", "comment": "Malware payload (AgentTesla)", "value": "91467438edea875326dfdb29ab49fa0cf082186babe04513fb611f8b5edb225ddb3888d275c166a1ff0dfaf4514a5118", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174662, "uuid": "828779ca-8d18-4793-9ed4-c704b1921521", "value": "T1ACB423D9D72C9009E57E4E110382FD3336061058AD7AF0C65F4CDF569E726BAAD81E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174662, "uuid": "039ec189-f54c-4a9b-b44d-e7ddad7451a2", "value": "12288:hvTiqu42mOMHQbGeGnuih+MGcUheRTzRHi:h9ulVbrRK+MG3eRTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680174662, "uuid": "95374e55-a69b-4dac-aeb6-90d280bf724a", "value": 494239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680174662, "uuid": "5a27711d-7f18-4425-a925-34341b689a89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174662, "uuid": "32f01380-e220-4b01-b18d-6cbe9c3a5a61", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000fe0da-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680158531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158531, "uuid": "ba7126a9-fcae-4a31-99c5-cce82a95b388", "comment": "Malware payload", "value": "116a72015ae3ffe1d32b994929de24f9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158531, "uuid": "ceb184f8-c5ea-4dd4-97a9-8ebc74e7512f", "comment": "Malware payload", "value": "43258e904b5b44010768e5e38d8be99d1fdd7aae8f7699dda4ecb8d037a58b89", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158531, "uuid": "c477ccd5-669a-4d44-942a-41ead8a7537e", "comment": "Malware payload", "value": "38c9dfb750df63f61aacf88bc94732a8f9fa6c2c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158531, "uuid": "c6f22941-f043-4808-bc90-12fae34809b9", "comment": "Malware payload", "value": "df1314adf79eb0c61724a68493c11503204ee9dd6f82ccd1ec74f7a6150b405f87a97b78043c24ae4cf4c1ca2c576ed1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158531, "uuid": "f897f4ab-14ed-47b1-b238-e8415acce89e", "value": "T170617B1457EA0208F2F2AB3A69FE62554E3B39569932C75E0059414E52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158531, "uuid": "d27ffcbb-6395-4c66-a606-c51c1d04b8aa", "value": "48:8wHaWU9Dmel0iglZ+dbslpQfYj1sAT1rTRRSJxodgImcC:8wHgB0+db86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158531, "uuid": "1b33d5f5-81e5-44eb-8cdb-d153910ba7da", "value": 3444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158531, "uuid": "20dca7f0-723a-4038-857b-45d6914abc32", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158531, "uuid": "31830ecd-ce1c-433f-9ecd-251b0373dbe6", "value": "IMG.32546545.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ae4346-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158425, "uuid": "c1942434-9ab0-46f2-9a5d-2227aa81321f", "comment": "Malware payload (SnakeKeylogger)", "value": "920a00d1fa7a8ee8959536f91e9fea9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158425, "uuid": "912f5585-667c-4774-854f-7ec1d8f1cf4d", "comment": "Malware payload (SnakeKeylogger)", "value": "43425b23fefe22aaec815793e1df744b2854d1ad1ecd0afaf9890e43d0a7db4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158425, "uuid": "7aa2804f-cfa9-4188-a745-4f80b3e88fc3", "comment": "Malware payload (SnakeKeylogger)", "value": "8219cf8fef8c9c048b972374c8e9d7b2eebec05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158425, "uuid": "52132d04-17ff-4286-99b6-bd3815a31aef", "comment": "Malware payload (SnakeKeylogger)", "value": "8ac8fc72781f4acbe247105deef8dc0f6824a6f0edb4339e9a9c4c403a591fb441d528cd180001604e78400b83e83e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158425, "uuid": "0870cc27-75e6-45b9-88e4-4273fba76cc2", "value": "T1FAD4020C79F99133FEBA46B708E123505B326764A235CBEACC95B4C83EA778594B0747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158425, "uuid": "4f24a78c-162c-4d61-95fa-f99f4c19713f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158425, "uuid": "52289664-5da9-4cdb-abbc-52f046462f8d", "value": "12288:qsAGUowq0HmGR6sIkXOO04Ko9CXzZdGCJcgr3kRdJdiZJL7:qpG+HmbOln9CXzHGCax/Jdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158425, "uuid": "d54147a8-480f-4244-8cf8-7622c8931ea6", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158425, "uuid": "609aef5b-d2d0-4175-bfbf-470ebad0ce18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158425, "uuid": "0948969b-e0fa-46d5-a5f4-a25b41c00f36", "value": "OI20220369 Offer Rev 00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e419d4-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680160821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160821, "uuid": "5ac35856-12e1-4132-9509-1c4d994e27a6", "comment": "Malware payload (Formbook)", "value": "718ea20df95d161c68617dfe6d085bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160821, "uuid": "631794d1-c708-4f14-acdd-09391f553742", "comment": "Malware payload (Formbook)", "value": "44b73a7929f70ff5632934c1048cefdb22783e2adb0fa5e59a6572c0fa3225b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160821, "uuid": "09f22b2e-4f40-4c72-adf0-11b3e1e3f14c", "comment": "Malware payload (Formbook)", "value": "68997c4523391c18799e03340d6e9ded82fb2321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160821, "uuid": "8c62b4e3-3f16-4d34-8d31-076b37679516", "comment": "Malware payload (Formbook)", "value": "198feb54e78e12565cd3cf5300a2af0ad19a6cac3e51119f5eb6d66fb763b405f51cef5606e4c0b9d1a92758ebc646fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160821, "uuid": "e10d9926-4cd4-4637-928d-09c9fc6c7a1b", "value": "T19F44125C72F4C8B7D93B0B361DB92692EBE5E42A21BD86135B40CE807862342DD5F763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160821, "uuid": "9ba7193b-b035-4c71-8b30-d73b714c927f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160821, "uuid": "92eef520-991f-4832-8959-090dfff5c6c2", "value": "6144:/Ya6Gz/5QY45xV+puvoMyIzIT5uZwQ5Zo7637NqPiLzE:/YQD5V45biuvoMrzq5AZu637PLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160821, "uuid": "3c5fcbcf-20c6-4fa0-a0ba-4a411e30aa9e", "value": 266450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160821, "uuid": "339fbde1-d111-4d5e-a997-0acfb92203ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160821, "uuid": "65232bfc-3e5c-4677-bf97-0806dac15054", "value": "Reference Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a350e0-ced0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680163000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163000, "uuid": "0cd59d52-3a20-40aa-9e1a-e74a6cd8b0fc", "comment": "Malware payload (Formbook)", "value": "35176b6172439d86d686003bea76bb11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163000, "uuid": "9106f6e0-a878-428a-83b4-2a69f4442e81", "comment": "Malware payload (Formbook)", "value": "45043a002e8f3d458e3dbde726fc373528fc485ba829b9b02b5826eb63069e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163000, "uuid": "4ab23a90-ebc8-4e57-9a38-4212c310b711", "comment": "Malware payload (Formbook)", "value": "33dac2f0cfc21a597fec4fa3ae8267a02fad1ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163000, "uuid": "0ec5864a-fe33-4ca6-b462-144bcef4bcca", "comment": "Malware payload (Formbook)", "value": "5617f90f6d0103715b61adbc44a6db369b21c81fc2af059cecb24e18c6f4988921685fef6715eb229647d210fbd01026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163000, "uuid": "3ab2790e-8357-450e-9080-3537a6f13441", "value": "T15705BE4C63544297E1142B39C6BDEE7903204CBCB9D1D7D0BAE9BE1BFAD67A6143301A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163000, "uuid": "6d206855-70dd-4f46-8744-b218f6cc1f6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163000, "uuid": "a4a393f7-53a1-45c9-b043-7c440b122969", "value": "12288:BeJ/sIJd7hLWPNRCrQdWCEHpBARn9QO4uc05UkxWBQWUMlyimOMt+:y4PNRCCPEHXAR9bbEeFimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163000, "uuid": "181ed778-8a69-4b09-97ca-ee56a30e5fff", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163000, "uuid": "55a49e63-b6b0-44f0-bd1a-f3fa34bb05ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163000, "uuid": "55d9dfa5-d68b-47c9-8fdb-fbd0892984f5", "value": "copy PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd037f4-ced6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680165423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165423, "uuid": "4ce449bf-afd7-41a1-80a3-9ff3f94f0d6d", "comment": "Malware payload", "value": "8ae07041e2b2c7201571f3b9541c3925", "object_relation": "md5", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165423, "uuid": "a69f1751-8bf5-4cdb-a754-c3d7c5f374fb", "comment": "Malware payload", "value": "462bf8a2e19a3e2dd4e5635aa5089e7bdc291d5c5c4665549f64f67abf0b598a", "object_relation": "sha256", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165423, "uuid": "2f7cc09e-8099-4eef-91cd-a9611d68baff", "comment": "Malware payload", "value": "f2c15ca4740fb2a1c11e8cd55181ba97caae3c77", "object_relation": "sha1", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165423, "uuid": "20ae262f-26d2-411d-9065-1b323fa39fc9", "comment": "Malware payload", "value": "5a4fd13741c8952561ad7d1edd8b9efe845f5f9ac4dfa704cdca13b93e33c53d30be0efc4a2eb27a7b1697cacd3e1b02", "object_relation": "sha3-384", "Tag": [ { "name": "172-245-45-213", "colour": "#6FBED5", "exportable": true, "hide_tag": false }, { "name": "kento", "colour": "#B8E776", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "PerceptionPoint", "colour": "#7B67C5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165423, "uuid": "d90f8a93-bb9a-4d2d-b0a5-81d7c8bf9a51", "value": "T14AE423E2CC72C824D9C300BA2983FAA544509ADFFD5A5E2324713B0D75F5BD49A9387E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165423, "uuid": "732f1f05-c94b-4961-a1b5-eadb7234b091", "value": "12288:CIjHiImv+fuHiMRLAlR88CQaAY3MjplVTK57xg/96LxY55W:DjH3+PiMRL98CkY3MrVqSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165423, "uuid": "eee19067-7480-4f09-bcf6-1a4beb0cb292", "value": 704320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165423, "uuid": "fb022b53-8913-4463-949f-0c2c4ef53940", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165423, "uuid": "467bc2b9-fbab-4b82-8980-32c0eb443578", "value": "New Section 1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ebf6cc-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680198315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198315, "uuid": "0744984d-05a8-4209-88e5-41823a3ff3fe", "comment": "Malware payload (Formbook)", "value": "0e3f3eb5dd8f952fff70c899fb57fbd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198315, "uuid": "fc6a4e36-d15a-4bf4-b796-16764c140a49", "comment": "Malware payload (Formbook)", "value": "4641b42cd821fb6e718c5dd437dc8fc32e2aceb188d863a45937abfb6c5ce5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198315, "uuid": "3fcdc2a5-1145-4b2e-9a3c-cc4dea48597d", "comment": "Malware payload (Formbook)", "value": "7271018ce44b5bb1e3a51692af4cbd55d77e553a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198315, "uuid": "a372de27-324d-4517-83b7-c572c36a8eed", "comment": "Malware payload (Formbook)", "value": "8d759fb8633d977dab05727009589ad5f62f977d4e4d6452d3fab427b3049916b76c6caed9300de1baa87a4efc446361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198315, "uuid": "fd89f396-68e9-4298-b621-37be8e3372d6", "value": "T1E654120426E4D577E8B147326A3A1377AFE6F83C7470661B63408A1C7E2A2059BDE773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198315, "uuid": "f9d56741-9458-4449-bb42-1b720cead367", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198315, "uuid": "ce51b592-c874-41b1-bd75-356df0dcb963", "value": "6144:PYa6FenQ26xIcdy2acE7aAPgmdDpBEEdkhcDAH2u4+tNq:PY3enQ6cdHVAPgmd1BJEcMWIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198315, "uuid": "cf4ea8ed-77e3-41cd-a103-2ef02d9d6c32", "value": 306008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198315, "uuid": "783d0586-fd11-4556-8265-b6fce60356ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198315, "uuid": "19e58f5b-6407-49f5-b0ec-6e662e814b96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4676d4e-cea1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680142969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142969, "uuid": "95cf794f-3751-4b84-b1d3-be06fa887269", "comment": "Malware payload (AgentTesla)", "value": "22e3eb7dd5f8f1d1d878b4927b3b6bea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142969, "uuid": "887e01b3-1126-4004-b5a6-763e0961143b", "comment": "Malware payload (AgentTesla)", "value": "479553149aac9204770a12980e2e1acffdacb0839fc516220253132f21e24f9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142969, "uuid": "e9e7d3e4-fed0-47d7-934a-8510960db21c", "comment": "Malware payload (AgentTesla)", "value": "8c6acd65028e4a68c4b646a61fc6ce9d860aa182", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142969, "uuid": "f595d004-20a0-495f-9d6e-ad911da4b32d", "comment": "Malware payload (AgentTesla)", "value": "e8ccdffcc0f191f5f9f9c287d8c436d0cb9aca5c7e32dc65d61e999e90352fa24c5a30977e6a2a73d231c37c47d453ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142969, "uuid": "aeded2fe-7dfb-4c79-ac85-ca0186f65b29", "value": "T10605D000AEA90B75F5E5C7F51930133A03A9BBA61072C5188EBA68DE3DDBF6345C065F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142969, "uuid": "16753503-ae28-4345-a85e-65ce176caaa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142969, "uuid": "444cf364-0fb7-49de-bcc2-cc48deb249d2", "value": "24576:F6UZGyRsbXzgGOHIOdauSIwi7+aBpexu:HZ2Xf6wuSbKdBIxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680142969, "uuid": "784d2566-edbe-45e7-a43d-c050012086f7", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680142969, "uuid": "1446a67c-3fea-4315-a055-2fb40be2a47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142969, "uuid": "8e6997d8-30df-41b9-9c1a-1818fb2efa3f", "value": "Purchase Order p3061 ODC 3604.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a5acba-ceff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680183019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680183019, "uuid": "0f1fb912-51fc-4908-a282-1c8b45413371", "comment": "Malware payload", "value": "799a27085d7788ef7703c3ba019762ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680183019, "uuid": "05795216-4136-4bcb-9384-8e198d9c748f", "comment": "Malware payload", "value": "47a0f5b4990222817b26d136a570926ac9022b8ef54a29144c17c0e531f0799b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680183019, "uuid": "0eb2f42d-c4ac-466b-817a-a71f0b2b4fcf", "comment": "Malware payload", "value": "5bf625df40a8f1925ae999c54bfa0f965422b8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680183019, "uuid": "b919c8b8-ea50-45b0-aa49-d6d22c7490ea", "comment": "Malware payload", "value": "2ce4280614cd7dfee8b4263a2abb5c07f6cb099d69a578249f10f053e0e3f91a66aa2cd1434c5716bca584e5a4fc393b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680183019, "uuid": "5e4d5c2e-ccfa-418c-a7f0-5710486516a7", "value": "T16DA36B4175D0C572D9761A334520CAB14A2DF9310FA49E9B3388167E9F712C1DA3AFBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680183019, "uuid": "e7cb5ead-10fc-4c4f-b978-e9ac22d62c21", "value": "019eec513a911fa71fd512630a915679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680183019, "uuid": "3a63abeb-8a11-4825-a51f-712d1447f028", "value": "3072:AICt9XX/Eakx5kZ8tmotU5sdDZqT2y7udyUA5dHGwRR+Nv:AICvPwkOYH597X7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680183019, "uuid": "b5a95372-b227-44f9-baa7-270f2914ea56", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680183019, "uuid": "a9736421-fbaa-4bce-b2c8-e4fd52c443f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680183019, "uuid": "2ce1b84d-7017-4ab5-be94-2628fc5ab9fc", "value": "SecuriteInfo.com.Variant.Jaik.94950.1023.23143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec63216-ced3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680164435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164435, "uuid": "85260c48-95bc-47cb-a7ca-c14dc66af22a", "comment": "Malware payload (RedLineStealer)", "value": "ed4dca7ded04f008741d2ad48a457099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164435, "uuid": "2e3c4d20-6875-4fb9-9d97-8d4790568c51", "comment": "Malware payload (RedLineStealer)", "value": "47bf3e3ff2ed7cab653fe4ace95ee75be75f6722eaf534ce4f2356585ac837e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164435, "uuid": "6e1de326-5cf1-4c0d-804b-6d7698c45bf6", "comment": "Malware payload (RedLineStealer)", "value": "bba4ceda671a4a2e2482380dce3255501176cc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164435, "uuid": "61d8f7b3-13fb-426a-a2dd-b9e8ecd85fa1", "comment": "Malware payload (RedLineStealer)", "value": "2b52c6773d42f15ed453054ac3f0e672d39d3065d943e86260f5c5650d1eeca37b71bb2cc74d8a4b5ffbf63a8192d2bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164435, "uuid": "9b061e79-22d9-468b-ab5b-2a47b71d9cc2", "value": "T1D134020B5B8C5A52D67E42BFA0C3D6B04312DC1B464FEB0B18C8AD777A363CA554529F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164435, "uuid": "5b96384c-3094-4fe4-b1df-e98777292673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164435, "uuid": "7f9f5379-31d0-4481-96d1-730fcdda67ec", "value": "3072:HdOS4krJn7I9UI15B4Nv1mPAb7FgjkOABnzpRwbyWikZ5SLt86W3FV32n7r+:HMrsYlNG6Ad5zpRwbyW12qNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680164435, "uuid": "7cd118fd-f9a4-4345-a999-8384a976f2b0", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680164435, "uuid": "2567119b-95b7-4f46-8160-eccfaaef3f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164435, "uuid": "98fb40d9-7895-410b-8ff4-2f71e0f09a3b", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c66295-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680219226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219226, "uuid": "7c204eba-f178-4c41-bbaa-376fa9c619f3", "comment": "Malware payload", "value": "34f708ff29f8baca07a2ad6fc47b02d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219226, "uuid": "b32e4c56-798b-4cb9-9d1a-43d15739f47f", "comment": "Malware payload", "value": "499ed7c7d185632909081495cbd02a56972c3386e77a52778f7b67b679418dfd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219226, "uuid": "88b0df5b-6ccb-441f-9bb2-544bd141d525", "comment": "Malware payload", "value": "147d9b2583b2430a20f52d8828699c2e67dad7ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219226, "uuid": "7039699a-a929-4e82-9a17-1a0c9edb0f3d", "comment": "Malware payload", "value": "e85b0775397c2ba4c260d54fa42c3bed1995fd8363b2ee9826614b23e6c3ed82b5b25fff1cd406745ec68fa2d2602c8d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219226, "uuid": "8295d7c4-0eae-489c-a183-894e919437c5", "value": "T177A3EC12F40AE71FC7A941B5488A937C33B97F0F8648E7E7A109B33978F1A60DA47954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219226, "uuid": "38409837-4d93-4b16-b542-282060aafd85", "value": "768:QgcFMo2zRrfCHuY26gfa3Z5quiV5mI0rAAF852m5bSRfblz3JShT5FcHuurEGESm:QgcFMVz9fcuMtzWNzurIt+NDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219226, "uuid": "eeab0e74-71e7-45f7-840a-6ebf782e5f6b", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219226, "uuid": "f6ff1947-e34c-4370-a373-65bd3c2fbfd2", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219226, "uuid": "4e399f80-b7b8-42c5-bc03-a67fa1ab3e35", "value": "SecuriteInfo.com.W97M.Invkay.18613.26453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6897fe27-cf4c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680216259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216259, "uuid": "3902f5da-8d2a-43f4-8fe6-d70e80044f0d", "comment": "Malware payload", "value": "22e491a919a5271782f04ac65dcde192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216259, "uuid": "f86d9732-3682-426e-9a20-a9dc77fe7aaf", "comment": "Malware payload", "value": "4a54cac2dc41301d00d1f9a27a16a8a33045c393542c56e063b290e5b446db22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216259, "uuid": "17f86403-bf9d-4ceb-93ef-c54a2b732b6b", "comment": "Malware payload", "value": "1b8a5377e4534798f72bce8bedd7e70ec73645d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216259, "uuid": "922de033-7282-4f0d-af01-49c1bc45dc60", "comment": "Malware payload", "value": "00c509942870530feb5122a7c8c5f54e925f08298fdf2540e948e25719e6d7b2c47686454b9a00c6821debee8ff5a7f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680216259, "uuid": "ddd3f81e-ef7e-4fee-909b-1fe6741764ce", "value": "T1A9F4E014E2CE8129C925723E80E7C1BC6321ECA5E926C7E37BC5BC9FB2B9FCA5415055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680216259, "uuid": "c86fdb68-9dcc-48cc-aa68-49847a3d5780", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680216259, "uuid": "7e2bd174-c226-4fa3-b8cb-4f4d14b09fbc", "value": "12288:i7inGzBKzcpLyBryMTFWSnoJBGhPUKVwS5yq5doNsrXSWI7OimOMt+:FsCty0FmEUDSo8qqriXOimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680216259, "uuid": "9104d5f5-5924-404b-82ce-9300e0e08ef7", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680216259, "uuid": "a31052b7-c6e4-43d9-951c-6ac622097e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680216259, "uuid": "0b29af00-6864-41ca-85aa-de115b21322d", "value": "z1DHL_AWB_NO_AWB4507558646.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e48ccc-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680170973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170973, "uuid": "1564bcfe-bb1a-4103-b0cd-7d0c0869f6c5", "comment": "Malware payload (Quakbot)", "value": "7d25ffe763196846b7cddb16850e9375", "object_relation": "md5", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170973, "uuid": "f60bcf28-d53d-42d3-b2c4-a84bf5e86a3c", "comment": "Malware payload (Quakbot)", "value": "4a7686d40ef63b3b8dcf8c40085e277c65de4e5b27f00199a51c3c6457f0bcc0", "object_relation": "sha256", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170973, "uuid": "9ab62fe9-bc23-4113-8639-2e8c37f467f5", "comment": "Malware payload (Quakbot)", "value": "7a1c77d0b10b02432e23c5f81dbebde2b4476e84", "object_relation": "sha1", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170973, "uuid": "76567cf3-a4f6-44aa-a756-26c7daa1f1cb", "comment": "Malware payload (Quakbot)", "value": "750cf9ca40bddb333e56ef3bedd90559749dfc61c0b2852badeacc79cc5dc579b698d8f3c27f95af1c86ad4ccb1ae96a", "object_relation": "sha3-384", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170973, "uuid": "034b15ad-e7bf-423f-8637-00a330b80d2f", "value": "T1A28142CA2F6131552A382B2BEF33D84B9D00A715171C984BF6A390ACBB1C658E9F3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170973, "uuid": "0f7d7e8c-8504-4e7c-a167-2271cd5c2323", "value": "96:0xD9FBsboZFmMCdI9o2iTwwyGDJBTWE1b3JsSxsT8SxZrkASxZRkwAWa/zSxZQSC:0xD9UoZ0lEf7GDJgMTy5O0RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170973, "uuid": "2647c22c-26bd-4a88-ab8b-f35fe6be7b28", "value": 4048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170973, "uuid": "35828cea-7c79-42b7-a405-8af67215bf17", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170973, "uuid": "14d8e020-09e6-4e72-a2f9-33cbe59d65d6", "value": "Odio.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ac6326-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158698, "uuid": "ccce82e2-79c6-4e5c-823b-2d5277cba751", "comment": "Malware payload (SnakeKeylogger)", "value": "083137b26d9558dd30c6774900bbdfff", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158698, "uuid": "1f084ce3-ee15-49f3-aeab-7fd36382c936", "comment": "Malware payload (SnakeKeylogger)", "value": "4c55c42aab61083faa4fbab0367430648725a8b7102ab55e05a0c0f6b4985632", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158698, "uuid": "084b460e-9f01-4a88-8886-76c6b1096aea", "comment": "Malware payload (SnakeKeylogger)", "value": "b8114d361f515dec029459c9d0a2a24fc08f42fc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158698, "uuid": "772adbb7-6cfa-4cad-8db5-fffab449412f", "comment": "Malware payload (SnakeKeylogger)", "value": "2cc78645a816185b242906103b96dd2352d18c298a08d9c6ac6dc5b5338588b609dfa3ba64d2e0c026d9bac40a0f397f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158698, "uuid": "022132a0-f301-482f-a857-d49349a4171f", "value": "T1C2351213F945DE86E089C3B09F972ED9830EBC42B3A7688311487B5F5F716A8785B24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158698, "uuid": "f6e941e0-55a7-4651-b482-afea73e5fa79", "value": "24576:ILKwSSMMednE4akAmmjmRakAmmjmw+MXUWxnu22222222222222222222222i2DU:ILKEMraaoeaaoz+MXbgFD4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158698, "uuid": "69fc982e-e075-42e6-a17a-88cdc34f6411", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158698, "uuid": "43ea4140-9cc7-45a2-86dc-4e0435823624", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158698, "uuid": "052ecb89-9504-4495-898c-7f88cc582019", "value": "SHIPPING DOC00000456563.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2241cf-cf24-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680198929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198929, "uuid": "431f4eec-f1e9-4d6b-aae8-7c7b522ebb81", "comment": "Malware payload (AgentTesla)", "value": "5d8586ba0e3d96a8319b0670301eee02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198929, "uuid": "b598483e-8230-419b-8f10-2f9ad71783a1", "comment": "Malware payload (AgentTesla)", "value": "4cd98fb6668986620818ee269211c338c653064350b2a319a25ea9ba48110050", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198929, "uuid": "c4401979-65b6-4193-8c30-47f0f6797afb", "comment": "Malware payload (AgentTesla)", "value": "0c1bc52f55e3b35ef78197f42f32a6592a89217c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198929, "uuid": "57bf82a0-d1d5-48f7-a4d9-805fd252d7cf", "comment": "Malware payload (AgentTesla)", "value": "ee49d2f4f3bf6bb0f8e2d7db26d5ad24f923594b4428843f83f735a091e248591249ad37893a68c3c21373a1d7099ef3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198929, "uuid": "613c90ad-f521-4139-8329-062df38050b4", "value": "T1C3E4012032ECD116D265467A81F1C1B0273ADCD9DA6ACB631FCEBD8BB3CE349552419B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198929, "uuid": "2ff00143-f638-4b68-82ed-7e33b2241b48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198929, "uuid": "81bb117e-0230-4f24-bf8f-9b4d0e2b9eea", "value": "12288:oeJ/sImihh+XJjR6ZiPUpEwCb+RImoQO7FZYisnSCKOQJAtimOMt+EM:tOJjQQFb+e1Bei9CKOQJAimXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198929, "uuid": "3484fd4e-7f2d-4c95-a7a3-f81df1228ace", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198929, "uuid": "69fffa0d-8074-4332-80d3-183642cc8705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198929, "uuid": "cfd73159-2033-4aa3-810d-99cac444a147", "value": "5d8586ba0e3d96a8319b0670301eee02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abaeff9c-ce94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137344, "uuid": "cb4aaa16-421d-4367-ad80-22a8ad0f6abd", "comment": "Malware payload (Smoke Loader)", "value": "639376664335231a89d68e63a091cf23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137344, "uuid": "9fcc781a-9514-49ec-98b8-823958273208", "comment": "Malware payload (Smoke Loader)", "value": "4d2d7253f92fabcfd3adc2b0f112f8ddde14c0e94b88c603fe332b2e5d77cd00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137344, "uuid": "8ecb68a8-c9b1-435a-bb3f-4a55c0bcf535", "comment": "Malware payload (Smoke Loader)", "value": "591946aa4917051b89305b73a981489fe3c43b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137344, "uuid": "4521a7ae-65fc-4b2c-93f1-24259f53592f", "comment": "Malware payload (Smoke Loader)", "value": "1ba4fc537411545f4114c0dcc443cee1675671cace4f19a865d854a1302b43a88f05555ab78659da489c8c05c0d7dcad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137344, "uuid": "675a6b88-861f-4452-905f-8482a42c89f0", "value": "T18444CF127692C472DA5A01BA4811CBB45B7BB8349F11CAEB3B9417BE4E313D2DF36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137344, "uuid": "46f6467b-61ec-4165-b8a0-4aa76a8fb311", "value": "6d0731e3d08b444b0205bbdbcc6792ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137344, "uuid": "bc286d2e-a834-4241-b28a-25539f9da484", "value": "3072:F9NHUpV5g8XLj5bzLXG5FEELTPvaI4nh1/wbsHEvDxdoegx4cj:ZHUj9Lj53LXKzYnToIH4xdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137344, "uuid": "24256337-7e80-4717-bf65-e30e5e2d37fd", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137344, "uuid": "e95ad29b-03c6-4731-a366-c7ff1dc265cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137344, "uuid": "6afe3895-fc0f-4a8f-a181-29cf094cf4dd", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce383a4-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158419, "uuid": "199b832d-8276-494e-82d9-6ecc446b9525", "comment": "Malware payload (SnakeKeylogger)", "value": "9ccbf489732c06f4b305a4859b29c88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158419, "uuid": "fc340614-bcc2-4d71-bee0-0ceb0972af2f", "comment": "Malware payload (SnakeKeylogger)", "value": "4d833b054ab8a92e1342bf015ae2348b5c88d8b5281a7bda7b5ef21e67926ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158419, "uuid": "c17a1339-6e6f-4261-91e7-ebe5878d5c6d", "comment": "Malware payload (SnakeKeylogger)", "value": "2365f0f033eb27a6b07f907fbdfab41adc782dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158419, "uuid": "d9c8871e-7433-427b-a719-346c69826c09", "comment": "Malware payload (SnakeKeylogger)", "value": "e3f989fa085086f4f4a8c5ce052b10cd0d8151eb839f4f1ca5dc844c660a9181b7ab5d74ae09ebe56a8e47aeaaeb539f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158419, "uuid": "e7e9cb43-56fa-4f1b-913a-b0b98423b241", "value": "T113D4F15036DC852AC665477E42F5C2F0633DDC89E6A4CBA21FCABDCBB2CE31664111A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158419, "uuid": "ce7de220-ed58-436e-9f6a-5bc6259a508b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158419, "uuid": "236ba61c-58f5-43c8-8356-00274764163a", "value": "12288:0eJ/sIqyOdhRvuguUFok/w6351YFJSSGWb5iJRqtZLL3TKF6imOMt+M:NGn9FT97YF3Gx6zfTa6imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158419, "uuid": "bc98b17c-783b-4ba0-85a6-5d33ccd50877", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158419, "uuid": "5aa8a162-73c8-4682-8dab-65057cac0854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158419, "uuid": "159a5e64-bc5d-401f-8338-ec038e2f93c5", "value": "belge tara-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fdfc5e-cef8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680180077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180077, "uuid": "f0e8bdad-5b7d-4ca2-84ac-13bee4a9b4ec", "comment": "Malware payload", "value": "d598fd562cd531b557bef2ebceb4a277", "object_relation": "md5", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180077, "uuid": "74a83dfc-54fe-4997-b423-43173e8bc670", "comment": "Malware payload", "value": "4f5ba87f8539711474e475c4e77c63dbb880d6bf4083b5fe97832fad6255b873", "object_relation": "sha256", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180077, "uuid": "e9e13163-ca93-4312-819f-99f22b80fbce", "comment": "Malware payload", "value": "b3d1c0971ff19f752b17d86089bf8ce95bb2373f", "object_relation": "sha1", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180077, "uuid": "4aae4642-a175-440d-9f17-20d6753e89bb", "comment": "Malware payload", "value": "d961ff65344b5632965395e4659a15b333d4f808576b426ca89751bb3b565db1010c5c8388a55eff360948a876e0206f", "object_relation": "sha3-384", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180077, "uuid": "63d4c723-d976-455f-bc5b-552d919f0293", "value": "T1F245338A6B182A8ED3274A5F6C517161C40EE2B50CB456FDB47D8199C940BB2608FFFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180077, "uuid": "e92a6aeb-ec89-4ea2-b8b3-f5c1cb23b754", "value": "24576:fl81sC0LFSc2OqWCRVV9mNmKFzHq35FrcPiSPKoM9fYkLY/:fl81slLl2OqWCR4NmgLSNSlM9fhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180077, "uuid": "a0bca201-f4a9-41e6-a334-49a8930a7cec", "value": 1213263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180077, "uuid": "38de5828-f412-4f26-906c-8e854b6655c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180077, "uuid": "d3683a02-3f5a-4411-b9e8-d1622f2752f0", "value": "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441461d4-cf1c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1680195582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195582, "uuid": "0d987426-35b2-4d7b-965d-c5508c8cdb65", "comment": "Malware payload (DarkCloud)", "value": "525b29804499f54683326bd36d358a40", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195582, "uuid": "f62f09d6-52c8-4b14-9873-8f629ad49b20", "comment": "Malware payload (DarkCloud)", "value": "4fc50d17362e6ed4e53b082e4d01ad286eb2caca5113ae09e48eca48889b36fb", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195582, "uuid": "a730e729-67f6-4ac5-9693-f32b21b277ca", "comment": "Malware payload (DarkCloud)", "value": "11c93e550822f2e4e8ca5366e1f2d270d4785ea7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195582, "uuid": "5e642917-b818-4ae4-a821-2cbbef5b0f6f", "comment": "Malware payload (DarkCloud)", "value": "340a140933c6c4d98c809a7e9e904bd2db33f398c4533a1459512069df56d32596bc60ad144e8d77327f8f6e116297ba", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195582, "uuid": "8cf471d1-c728-4acc-b538-f8fe4498afb8", "value": "T19945E1C0E1886598EC1A5B3940B9D8309337BEADA975D51D6ED9FC637BB32C32026C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195582, "uuid": "d08d674e-c694-4985-b3cd-5404c6561158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195582, "uuid": "1480491f-2616-44f4-b44e-62ec3c396682", "value": "24576:ZmsNORPPda72PV1sjlty/+gpd9O2hyyL7imXSQ:ZmnRPhD3bf9O2h9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680195582, "uuid": "c769523e-f4ee-402a-aba7-aa805df96698", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680195582, "uuid": "d803be50-88ef-4ee6-a01b-9bfc41747201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195582, "uuid": "2415de99-73da-4bcc-b7de-f6c210ec3857", "value": "Purchase Order Specifications for March-2023 update.pdf (253K).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1563aa5-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161406, "uuid": "905971ae-d567-4a54-84d6-0228aa2c6739", "comment": "Malware payload (AgentTesla)", "value": "12bfa10b8105b942d4a054707f590650", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161406, "uuid": "4e046ce1-02f8-450a-81cd-7512c5756624", "comment": "Malware payload (AgentTesla)", "value": "5020f288ce75458c32396de7fbf75933adb16ae00d868f999667ee34a2eb295c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161406, "uuid": "78f49652-0b3f-4f9c-ac5b-2c8c26dbfe87", "comment": "Malware payload (AgentTesla)", "value": "12173094458ad550c426c3d7169237e6ea1084d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161406, "uuid": "6bd7e92d-12db-4be1-9e21-cbd7ddf0cbb4", "comment": "Malware payload (AgentTesla)", "value": "5d5b9f3ea754853658f6741af36c6fd61f7de9254396341b86126a3baab9e9a2de39622261b41397956d422f18712d2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161406, "uuid": "9db09170-3cec-488f-871f-b077ce316385", "value": "T1C0F4121036EC811BCA75877981F5C2B06379DCD8CA79C7A61FD9BD87B2CE78A9420097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161406, "uuid": "19c4769d-6d08-4744-87a6-3b938afc5463", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161406, "uuid": "fbc943a5-5b1e-46c5-a079-b532bb7efca8", "value": "12288:GeJ/sIAKqh1imOMt+zPPHzuygXTkGwkaSulRQ/Oy7xea3nWV5qnJ637rnt+xy7rt:yTimX2TuyMIGBaSurQGqd3WYJ63nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161406, "uuid": "f97bf664-298b-48fd-b6ab-4412a0eb06cc", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161406, "uuid": "6066c920-cbd2-4d3b-8f9a-24db909fd20c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161406, "uuid": "8b11c369-e50c-4bbd-b6c8-274dd9f27f77", "value": "12bfa10b8105b942d4a054707f590650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06969fbe-cedb-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1680167562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167562, "uuid": "96b7ab83-2af8-4b6e-86cd-3e16f7e36879", "comment": "Malware payload (STRRAT)", "value": "5fa76470580f6244eb850183ded7c041", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167562, "uuid": "38431158-02ac-4486-a40b-9d00c1adc6d4", "comment": "Malware payload (STRRAT)", "value": "5042fd2f56529317fa3c99e6423ff32650b8cac32f6b8e63df4669a58ce2f5b2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167562, "uuid": "e0a327f3-a8cf-4748-b076-2da9d5a0744f", "comment": "Malware payload (STRRAT)", "value": "d31eabf0b7f72723d037df96f9ec583f0fdf2413", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167562, "uuid": "2fac7882-3da6-4159-bbf8-6032f393aef8", "comment": "Malware payload (STRRAT)", "value": "9203716317b2e1bc8b647134d180bc663dfdd5441a384658339ebf7479b02024588bdea20013a8583658888d85925d0e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167562, "uuid": "8e5a7d3e-4c4a-49bb-a4c6-33da9c53aba2", "value": "T1A524010AFD6EC3E4D11B4A761059A13ADA0C53E8E547A5BF3AFD1145283CD2E1703AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167562, "uuid": "11b4b10f-0663-46e7-8ae8-393533d66256", "value": "6144:DG4VsjG44y8S3Eg5xRykIkQzjPZy4oRpXh:DLVfA8S35pykK1rQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167562, "uuid": "25ba688d-e931-4078-95aa-5f1f067169ff", "value": 224615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167562, "uuid": "1d4835ea-5fc4-4319-9495-2db9e5495c67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167562, "uuid": "95b0af55-c3b1-4146-93e1-d4984d0796a3", "value": "PO 5116877_88639064_GMD PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdd536c-cefe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680182846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182846, "uuid": "8325ba96-d37b-4e81-b96a-5dddf2c30513", "comment": "Malware payload (AsyncRAT)", "value": "652dd5b56989f5ef5cb33759bf1ccbd0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182846, "uuid": "a3d12521-efad-4ff7-9f35-d3fbe04214ac", "comment": "Malware payload (AsyncRAT)", "value": "50780178c6e35fc1107aa6aacb09c6d1a46d2200f909a95836c88cb7c3651c0e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182846, "uuid": "0d52f34b-5673-4ea1-a16c-1c70e16b6e1c", "comment": "Malware payload (AsyncRAT)", "value": "c7ba417514e93c71af7298ab9ba0c004079961b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182846, "uuid": "728a50b8-8262-4f03-b43e-5890357e7894", "comment": "Malware payload (AsyncRAT)", "value": "a86346bc05d0c2ba902bdba039ab37af409369b20e510f4f413a3afab0d2208a171638cb66e64889d7eaf128ebc60810", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182846, "uuid": "2bbd4f69-585d-48be-bb64-96f25dcfe6a3", "value": "T1B2D4F142F6D648B1E5331A354839BB25A87D7D301E34DA1FB3D87D2D8A32291A235F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182846, "uuid": "df07abf9-7204-4d07-91e0-7f4bc487ba80", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182846, "uuid": "230d9a4f-0578-431b-94e5-78e1ed039194", "value": "12288:NcrNS33L10QdrXjcDn/ecGKnIiAnoXxDR3KUKLpFQBr7JFWpzL:wNA3R5drXoD/pfAnoXpR7kpFQBvJyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680182846, "uuid": "0ab614bc-0116-40d7-81b1-99c401e375be", "value": 638075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680182846, "uuid": "ecf56404-f2c0-4dc0-9a60-555fcdcb7415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182846, "uuid": "384aaf16-5484-410e-99f8-35eca8567965", "value": "Pago.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c718d3-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680161420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161420, "uuid": "305ea3ad-2c7d-40ef-8871-e1d9d0411aa9", "comment": "Malware payload (Smoke Loader)", "value": "22f50ef32d23e0f441da489071ca1ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161420, "uuid": "3c7f24d7-7341-484d-8da9-87dcdcd9b324", "comment": "Malware payload (Smoke Loader)", "value": "50ae1cc086fc3faeeb453c5923097b9328b63bbe19ed9f9c226bbb1b49a1917d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161420, "uuid": "c85285aa-a838-4287-ae3a-c43ed299f8cb", "comment": "Malware payload (Smoke Loader)", "value": "b3d1136a952d4c15df83178595e89e2f643ac89e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161420, "uuid": "966d7d89-8817-40e5-ad1d-df709b1fc364", "comment": "Malware payload (Smoke Loader)", "value": "451baf27028461f356cf3256e74dc8f4dde1b2c5ccf0469653c79acf61133e9396647c5ba90bfe946e51c3f0d1da1cd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161420, "uuid": "570a6e2d-9ce7-4fcf-a3d9-e1d45c450960", "value": "T1C0D45C3C1BFC8556E139D7758BF44C20E7EDB4177636CE1E79EA00890A26A42768336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161420, "uuid": "500e72ae-65b7-4210-b302-46d7f7963b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161420, "uuid": "061d78d5-0ebc-4695-9d5a-bf4755fad06a", "value": "12288:xQxy0FBF2J5SWzDv7SMvUvH8QKuyywV36hu6:xkH2J5SWzDvC8QVwV3C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161420, "uuid": "f2c5fd9e-1fc1-42e2-b1d9-b7d4f62168a2", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161420, "uuid": "456378f3-9152-40a8-b582-cefb652f16d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161420, "uuid": "5d450b0d-2cee-4491-af5e-3d67a14082f8", "value": "22f50ef32d23e0f441da489071ca1ecb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f8d09e-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680196773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196773, "uuid": "d5bda9e1-2c94-44ff-825c-da56473acbb9", "comment": "Malware payload (RemcosRAT)", "value": "26b590d41fbcc2741134c3fb52507dfb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196773, "uuid": "e72e1603-7952-48bc-a3da-7a3e483b6385", "comment": "Malware payload (RemcosRAT)", "value": "50ca98ba2d54858b97cbbfff758edf7f81a29a8a4884a4319ae994cb8a434de3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196773, "uuid": "78bcd426-a419-4b30-ad3f-ae9f7d21aa7a", "comment": "Malware payload (RemcosRAT)", "value": "0ca4c0eff139395f381b9c2dfc18aaa5634e9d3c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196773, "uuid": "e609097c-27af-4649-b173-0bc483bc383a", "comment": "Malware payload (RemcosRAT)", "value": "f0f65b52d4ac04776f40f1f1be9517f7a7c95cb393a423b0012fcd71d209cbfeb39bb6a676ca580e2636f64cba07d401", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196773, "uuid": "6e3fe4f6-3be4-494a-9fe2-0955a1270826", "value": "T1EF2512147BED960EE12A877C86E4C5B06378DDC4E222CB530FDDBC97B39E3869912452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196773, "uuid": "06574ba3-d712-4d7f-a8cc-c0b347f0fe21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196773, "uuid": "b3c2ffbd-b098-4240-b433-7f7ddad6034a", "value": "24576:dBpSUVpLFZvLdF33lwPfDf1aZsTDe9aimX:dBgAfLdFHif1M0q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196773, "uuid": "48c7ce20-44de-4476-8031-81701c3f378a", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196773, "uuid": "bb163b5b-2d0d-40e8-8e74-a4d5ef8ed4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196773, "uuid": "1b8ac28a-aa25-421b-8f7f-29785a44a48a", "value": "DHL-EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee18ead9-cf0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680188136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188136, "uuid": "0aade9a2-2bd0-4399-9620-8aa0e8dd4e22", "comment": "Malware payload (RedLineStealer)", "value": "a315e6135e4791b3cc9b8fd5c2f21850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188136, "uuid": "cf7629b4-a80e-4290-b5ce-3c32c4e45864", "comment": "Malware payload (RedLineStealer)", "value": "51661628d61802d22c36d3f48ee7226a1ba58da16895556a453c0041e2d3086c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188136, "uuid": "05989608-e7ab-4455-ac2f-c2b685e87c96", "comment": "Malware payload (RedLineStealer)", "value": "a41dd3e6e2e2561652354e4efd2f4fbd77c74fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188136, "uuid": "3299794b-e43d-41d9-810b-8d49d7ad5a7b", "comment": "Malware payload (RedLineStealer)", "value": "3bbb1da2defdf07a4719ae623f37b27497e36eae258813e3064078d24320f4b72eb3adcbc8fd87177deb9acc1ad5dde1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188136, "uuid": "07b65e13-9a88-43d9-9a51-8ad2dd704b02", "value": "T129C48E1B93B86820D5730771692ACEB8161F7EA06D36F75A16E8FC3B3B72292CD51305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188136, "uuid": "8513a1a8-c6a8-436d-94e6-81e6d5b11f03", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188136, "uuid": "5de8ccfa-f5db-4c90-9abb-6ff1d94081d8", "value": "6144:6DfisqeaAuJ/HFlzx2+0SFMdc9twdWhZkNb7Wwh0kmSKJLAPlhJ/:6bibeButzd3Lh9GdWzIjcLIR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188136, "uuid": "4b95d3e2-2aac-43b2-a13d-2d7949b36e0e", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188136, "uuid": "cdc662e6-2758-4674-89a3-03b19ca6cbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188136, "uuid": "51cbe094-a067-4fcd-a63a-5c16742a8ed7", "value": "a315e6135e4791b3cc9b8fd5c2f21850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a521b2f-cf0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680188291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188291, "uuid": "4fb09562-1902-4bf1-b208-4818ae2570f7", "comment": "Malware payload (GuLoader)", "value": "be1519bcbdb5a58fb2bb3ab5dd51ae1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188291, "uuid": "5f31b929-2eb3-48fa-bb7c-37cb235ba0d3", "comment": "Malware payload (GuLoader)", "value": "5193149e55e9ed83fad3ad981ba16230771cc2d3a90ef1f9fba9d9f5b5b2519d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188291, "uuid": "c459f4e4-2a23-4608-9caf-457fbfaddd4d", "comment": "Malware payload (GuLoader)", "value": "ba25e963f2c56380d82188203aec956dd2c81a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188291, "uuid": "b24d2022-af41-4d8b-9c29-c4bf15e40bf0", "comment": "Malware payload (GuLoader)", "value": "c7b3fabfa90c4b6e17e897a6a15c9583f32a5ed44ff37e8c4824d5341df1ef87a98ab0452537fccf64554f830b6bd70b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188291, "uuid": "c2fe4f13-5853-4154-8c8d-b0f89db87d06", "value": "T1F23412E57050D063EF6B163519B27D1633B6ED0858E8DE0BF7503A057A23BE0A6272B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188291, "uuid": "90c58fde-9ac2-4903-aa24-3fa9af8f52a6", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188291, "uuid": "e19634f9-c6cc-40ad-86d2-f977ffc34629", "value": "6144:+PX7iNebSdJ8DckdV+opbGA5Siwrd987k:5PYckdbGmSiwBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188291, "uuid": "bfdefd9e-8c4c-42c0-b895-989ecae06abf", "value": 238112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188291, "uuid": "ca204f47-c85a-4811-aa5c-b272f5d97213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188291, "uuid": "a5c3b547-e3e4-4203-a0f7-ee97cf6480d5", "value": "be1519bcbdb5a58fb2bb3ab5dd51ae1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665654f9-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680196928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196928, "uuid": "f3b5e1e9-c17d-49d6-b39e-7304839f3843", "comment": "Malware payload", "value": "f5b4002365ec9f90dbe09fdb55a39c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196928, "uuid": "60c26e03-2ee2-40bd-8191-203a8df311c1", "comment": "Malware payload", "value": "51ad039741a89ea696e1615b9f73ae6b9d32fc370b569f8ca8c97758923420e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196928, "uuid": "c66b4ea5-b630-4b0b-bf36-c6394e940efc", "comment": "Malware payload", "value": "66f4890785e2ae03030f7415ad17f2085ae26b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196928, "uuid": "ad363e1c-5137-4bfe-bf93-b798fc02203d", "comment": "Malware payload", "value": "cedae53da6a5f151c9cf2213627ffd6e434bcfb0ef5c3ecf5b84b479e1f5274dc5eb855b35db2844a1cf99e0ad914cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196928, "uuid": "b778e329-c1cb-454d-b17d-f33e98555ec4", "value": "T1FBE38110B0CB8231D5621D328DF6B658B738A6200F3B5BDB339C29791E6429CF5F9997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196928, "uuid": "9a731308-b0c2-4f93-b7d2-715b086e72c9", "value": "f9bc3148c018141ee2f71f80e961fb2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196928, "uuid": "04e2d335-0fe6-4c8c-913d-b2d41c7a5e3d", "value": "3072:yueuUO2d+UMH7RCibjDouqQ0/IOvrNT7eaA6DXGEd29pSzRKnW+qXQH:Q/IOv97eIjlz8nWFXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196928, "uuid": "a753b122-c90d-48d2-91a9-ebdb2dba9dc8", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196928, "uuid": "a11125e4-0024-40ce-a07b-a2076b761e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196928, "uuid": "547f2f59-0edb-4033-8f16-b33274cd25c2", "value": "f5b4002365ec9f90dbe09fdb55a39c4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2893c08c-ceda-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680167189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167189, "uuid": "e53a585d-28e5-4be1-a64a-27c1cf428615", "comment": "Malware payload (AgentTesla)", "value": "4c491eb25d70911a6d26c3f51523da79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167189, "uuid": "f4079181-4d9d-4e0b-aee8-ec5af9ee0048", "comment": "Malware payload (AgentTesla)", "value": "526e419ccd5c187f23892752d36e79a60344def92b736f9c583429b6fb817f9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167189, "uuid": "59db34b8-2851-4b95-bf1d-b7ab3d4f507e", "comment": "Malware payload (AgentTesla)", "value": "268dc742854357a81c567b20d1554920a23d3239", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167189, "uuid": "6cb2aaa8-b4e1-4f2d-8405-230d2b7d5056", "comment": "Malware payload (AgentTesla)", "value": "77edb152b8644879639b50187ee347208665e514784eb3817c9930ef239de94ac54f800da79bad16e507694075ba0787", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167189, "uuid": "b0605a2c-4bcd-43ef-b72d-b4b1cc70fdf7", "value": "T1B3159EA77643DDAADE18C6F918A5FABC329059D42F506A4DF20831C709B933CDC86F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167189, "uuid": "24f59a9b-cacc-40f7-85c3-38364a2c2d1c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167189, "uuid": "95619624-242b-434d-8d32-5c4fc357a2d4", "value": "24576:RHvFFMaiHSTm6ijgrWavKGXgxBJrTYn4iT/5U:hvFFDiHSTm6ijgrWYXg6BhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167189, "uuid": "cba3c76c-d55e-473b-a1ca-741b355136ae", "value": 914911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167189, "uuid": "e371fd04-b26d-4aed-9905-6df4145b1b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167189, "uuid": "8353d187-c992-4a69-90e7-ad7328fdd92e", "value": "PO#23085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ceb6bd4-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680160942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160942, "uuid": "04e70594-a7a2-47d6-8fd8-7b2a86fa8dde", "comment": "Malware payload (Formbook)", "value": "7fe7bc5f3071dbcedf948751c318c341", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160942, "uuid": "efd8739f-3579-4d8b-9e9f-6b0fef602e4a", "comment": "Malware payload (Formbook)", "value": "5344fdd5ac0436f1da4ad8f03205b543cfc054a5e6387361f7855d7eb08cfa2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160942, "uuid": "666d46a1-ca17-4623-9f85-d2bcec410c23", "comment": "Malware payload (Formbook)", "value": "de33b3920bf847b133eab5006e32fc8562d819c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160942, "uuid": "313c3f3b-48e1-4b04-8f5a-7afd7fe97d64", "comment": "Malware payload (Formbook)", "value": "94fde087e6b887e5efc0babf31c24046148429f93d204cb6489617ee89cfc2135c196c5dbd727da6e8f7fe416fc1b1a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160942, "uuid": "cd07710d-ae1c-42b8-9dc5-cedf05521065", "value": "T1D265D016BA44CB11C2AD4B33C2DB141447E74E96A723FB0F3588369949133BBED5E29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160942, "uuid": "6346868d-b377-4cb0-bdb5-2527339bda46", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160942, "uuid": "b804c362-b2bd-41ca-87f0-84a857c708d8", "value": "24576:UDMBF8Xw1nCyIP1zmCdZQeXVHer/6SKcvTHCWTfND8qA/vAEXNhqgC:USssrIPwk4CgCSf11A/vAEXNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160942, "uuid": "8134856f-8978-4220-921b-8b0a9db4c32a", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160942, "uuid": "657b5491-0e9f-4c26-bb0f-e7b72124444c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160942, "uuid": "fb196710-e705-4545-9f47-f78f675ec03e", "value": "stage3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9603406-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170895, "uuid": "fdfbac40-9f41-4bde-8c8c-9ff8960188b1", "comment": "Malware payload (Mirai)", "value": "7f2c11311882fe4cc83f04552dc505b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170895, "uuid": "d304e643-8ecb-4d24-8af7-1ad4852bcff4", "comment": "Malware payload (Mirai)", "value": "534c2b8209d87e2b95e7f74500942a2099a6d8c11bb8448e4ec721968b1ee7d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170895, "uuid": "48fd8e5f-56cf-45aa-87df-b26696464fbb", "comment": "Malware payload (Mirai)", "value": "cb48d2705ab426a17cb7f37c4d7d111d22da4432", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170895, "uuid": "6feac421-d22d-4f21-8d6f-021191915b3e", "comment": "Malware payload (Mirai)", "value": "db83728dc4ce39d66026d54d008d323a95789188fcfed214cb10a6881c7f3aa76f0612d7c22cc24ff0cb9cc45884a0ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170895, "uuid": "40771c84-c24d-4caa-b769-fd9b30004198", "value": "T134436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170895, "uuid": "f729745d-8b99-41e2-ad70-2bee5179874b", "value": "1536:JeESt/basV2rcZhG6ySN7naapW1ZzWOIaEjrqMKs:JeESt/basVTgS7naaw1ptXES1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170895, "uuid": "2595d940-eb68-440e-8b99-bd24677fd37b", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170895, "uuid": "f3934880-35f6-49f6-8fc9-3f7075d904ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170895, "uuid": "ac2c9184-0a92-45fe-adce-db092264d71d", "value": "7f2c11311882fe4cc83f04552dc505b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90c36f8-cecf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680162707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162707, "uuid": "9b046c0c-8c83-4f21-81e6-2771a7774e81", "comment": "Malware payload (GuLoader)", "value": "482763510b94fcba0f140baf71913c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162707, "uuid": "b30f6d64-c86c-4932-99b8-5abfa1491eab", "comment": "Malware payload (GuLoader)", "value": "536a5d0e0a0283a2037d9a01efaf92c4e119647ad3b8aa4d644461de984399f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162707, "uuid": "a0b24b73-f4b3-4585-b464-e1a10df879e5", "comment": "Malware payload (GuLoader)", "value": "0b80a3603e6a919232fb2ef003e56baa15f52f75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162707, "uuid": "9b3c1862-58e3-4531-bba9-5b741ef048ba", "comment": "Malware payload (GuLoader)", "value": "53df5c8c0fa23a43c5277582e268514a0aef06c6e3f050eaa264a17b84514d68b95845a516c898dfa4b5fcedfac4f03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162707, "uuid": "12eef697-6ab6-4a8f-9410-84f00f35cd18", "value": "T1BEE41241377CDA23E6A6787F6022B25C31FEAE106A55C965B6633EFE5D783012D0B203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162707, "uuid": "10af3d49-85f6-445f-8277-da7cd7f07b88", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162707, "uuid": "ffc206ff-9aea-4226-a4e2-b8f5ba16ca3c", "value": "12288:vMw4EAPcLqbFLPc3eBxnt8pxlZT3yZrn0aHDyq9DSXALFW+JGcaLUn:vMwtAPcLqbFPseBxyB3yBDyq0GlBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162707, "uuid": "886aea50-a2fb-4dc9-b17c-1921fb81502d", "value": 688272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162707, "uuid": "e9a11a70-d621-4987-800e-65fb1925af33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162707, "uuid": "427ed73c-e2ef-43aa-90c4-05ebff60ad02", "value": "RFQ 071.23 020.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fca2dd-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680219179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219179, "uuid": "f2ad1fed-34ac-4919-a2e4-74633be484b3", "comment": "Malware payload", "value": "0bb6ef7f4d8a29f57332c41e70f557b4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219179, "uuid": "a4b627b0-f0cd-45ea-a2a8-d3d2d6375563", "comment": "Malware payload", "value": "547e34240e1fed85db1fb3a7e2a528290eb7ec5c64257b10fe6e2fc0654e3bc2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219179, "uuid": "015dfc06-f70d-45a9-8338-0b9ca3eb8882", "comment": "Malware payload", "value": "1fadf8c516daa6a0e551cde40c6ba309810bf17e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219179, "uuid": "5ccff153-f32f-450b-bdc4-71dee2c5b15b", "comment": "Malware payload", "value": "9f702fff8d2c45ddaaaa38cd0e44b497db51dd1f887300a582fce28191af74da7955368a6f44c19f6d9f7db08bfec403", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219179, "uuid": "82dff93e-0b01-4105-a824-e14ca0a54626", "value": "T14EC31842F686C62BD75512360C96C3FA337AFC46AE53874B3248B32E7EB7A54D452306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219179, "uuid": "a0e7e3fa-0714-4c65-8740-fcf54f2c72ba", "value": "3072:trk3hbdlylKsgqopeJBWhZFGkE+cL2NdA1saIJxrJukgjFN024hYuF5SAxW:Vk3hbdlylKsgqopeJBWhZFVE+W2NdA13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219179, "uuid": "3e31eb8d-f11c-429b-b45e-ea6fc0b30e10", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219179, "uuid": "deee7d4e-7166-407d-b20f-4865e0b5f7c2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219179, "uuid": "96ec31bf-3c99-4851-a915-581d188f293f", "value": "SecuriteInfo.com.Trojan.BackdoorBazarSpam.GenericKD.37165815.18046.29024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d01ff18-cee0-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680169800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169800, "uuid": "e6b23fc5-67de-4975-bda4-d3a95167d3e8", "comment": "Malware payload (SnakeKeylogger)", "value": "2568de65fcdccbc160da2452452cbe09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169800, "uuid": "e964584b-5db9-400e-8636-a2424d3b03d4", "comment": "Malware payload (SnakeKeylogger)", "value": "559b97a856fca272b7f5891100f1317d5f4846d12e86d113c8334c9861e4b026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169800, "uuid": "7bdefdbb-1ef5-4c5d-b770-0f61c142bd4a", "comment": "Malware payload (SnakeKeylogger)", "value": "38e434176706827e20a786de0bd656218005c9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169800, "uuid": "4f1d2dd3-0ee5-4eec-96d5-db9ea625b2e4", "comment": "Malware payload (SnakeKeylogger)", "value": "c8c858c0b92241569610a9e9471cf9791c2aed20cf6259c4f27dd4c03abe9e16001d4faf2a7b6ccb359c80389eae7e0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169800, "uuid": "35dfcc6e-2fd2-4e4a-a2c0-b3c0ee273700", "value": "T1E0155DD1F190C89AE85B45F1AC6AE53025E3BE9C94A4810D56DEBF1776F3342209FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169800, "uuid": "fae7b6ac-fc5e-46f2-810c-a47b67cb8ed0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169800, "uuid": "5336620d-3842-4a93-92e0-a005842af467", "value": "12288:xk5+ytZpYWHE4SODt+cIpPrzh8x55thIimOMt+6I:xy+yyWk495+cIpPrzhethIimX3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169800, "uuid": "0edb6968-a36a-4c64-ad93-12dd7a38bbdf", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169800, "uuid": "6f76fbea-dc7b-4794-a5b3-2b4fa139d051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169800, "uuid": "11c3fbb4-d0d6-4b9d-8ec8-2a235862b8a5", "value": "Belge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7a6c81-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680200910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200910, "uuid": "3fb6a30a-78fc-4e5e-8f23-e62d969ea998", "comment": "Malware payload", "value": "c8bc262d7126c3399baaec3bee89d542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200910, "uuid": "e7e2a3ec-ab09-46e9-9353-59986cda9eb1", "comment": "Malware payload", "value": "55b9264bc1f665acd94d922dd13522f48f2c88b02b587e50d5665b72855aa71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200910, "uuid": "22096f94-5046-431d-8bd8-843550a0641e", "comment": "Malware payload", "value": "c94a0f902b3b8cc4ca5e4cc9004ac9eaa4614699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200910, "uuid": "d4d2fab4-b573-4179-9150-fbe92a61840b", "comment": "Malware payload", "value": "21da6295bcb147c337a941ac5ab85626299cfcad4133287c9d068db706071281b43362cfcc014203c1bf5c0bcaf8d428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200910, "uuid": "d83a0962-a966-4abc-a848-b562198f12c4", "value": "T10AB64C03FCA214F9C6BEF13482959332BA71349983313B975F9499962A65FE47B3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200910, "uuid": "138ef706-3bf6-44da-b5c5-2d612998abfb", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200910, "uuid": "ef94b8e4-42e3-439e-9c25-7bb37f8ba27c", "value": "196608:3YHvhq3/BuNnKkOeXtqugiGk9FPHxgc/uA63+w0IUX:kQBuVku1G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200910, "uuid": "031507f2-e861-42d5-991e-9505eac406fe", "value": 10532864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200910, "uuid": "064bb1c8-a14f-4bdc-a491-521162650db7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200910, "uuid": "5706d908-82b6-4d29-b684-bc0f0b8f58c5", "value": "SecuriteInfo.com.Application.ServerProxy.A.341.15584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58a130d-ced1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680163587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163587, "uuid": "dca2db0f-97ee-46ad-bced-95ab75574bb1", "comment": "Malware payload (GuLoader)", "value": "d7f449eff461574ea85227c72a289c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163587, "uuid": "30d4c22d-36ac-439c-a8a0-5f72385a63de", "comment": "Malware payload (GuLoader)", "value": "5659a18a756596e040bbbb6cf4e6d08313ca6f3e3740ac6cc75b68d0f29d326d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163587, "uuid": "866779cb-15eb-4a2f-95eb-837e69fc666a", "comment": "Malware payload (GuLoader)", "value": "fcbf3802c2f7da452fc9a43473b38dfd7f90b9df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163587, "uuid": "980c7d2a-e483-483c-bdf3-1f7b161ff001", "comment": "Malware payload (GuLoader)", "value": "4098e376298e6fe072da2805aa92ece75e0eeb2be7b8630d64653e5e3b1bf77ca890b17ee4576cc75c725b825c54d4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163587, "uuid": "68d63ae5-962c-49fe-bba0-2d671d871ef7", "value": "T165B4E0346BF08022F8E6CE714EE1D4B53528BD90B9F566D367007B7EE932241678726B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163587, "uuid": "b7018591-ada4-45b2-9c21-6c6069db2514", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163587, "uuid": "d8b0b111-0d58-498c-8d5a-de9aa1ec50eb", "value": "12288:9z9GxaChlC3qKOcVbNdgCpgwDjKVcuVQ5PjyLj/pR5RgNGhZNWsjG1E:KC3iKNdgwDQcuiBjyLVXRXZNWfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163587, "uuid": "e74e6997-aed1-4e4d-be91-7c9938aaa20e", "value": 508904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163587, "uuid": "4a5d249a-f88d-4232-91fc-782602d518f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163587, "uuid": "5c6f16dd-b4fa-4761-b9f6-4c002bd522f5", "value": "P-200578911 PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab82e49-cef0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680176776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176776, "uuid": "6560dae0-1335-4fc3-8e82-15ebba38551d", "comment": "Malware payload", "value": "4d5d951f2033e7e926395e8e0f7de847", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176776, "uuid": "4f4a836d-a725-4e26-9204-7d13287252aa", "comment": "Malware payload", "value": "565cf3cb7e799c991fba39f507a122bdaba81624ed373f467422f57edecfe399", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176776, "uuid": "fdd09810-3fcf-494e-aacb-89a10a258419", "comment": "Malware payload", "value": "03f18dc5c1b11231994774ed277439607e89ade8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176776, "uuid": "036be4f0-022d-4c46-9ef9-f331e87b16d6", "comment": "Malware payload", "value": "6f890e794f7bd0be0fff9492d8ca3db6af4c7a671ecd4c6b947fe58063885074b6bb2b0fb573e71791598e8b11715d66", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680176776, "uuid": "0a46d1de-97b1-4f82-bd5a-b7e984ff0140", "value": "T1F794F0867686CE23C29B8E74ADA79A4C7238FC299F09971B33D47B2F3C757902451346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680176776, "uuid": "15c81363-95f0-42aa-bf5d-28fcba959cfb", "value": "12288:6cYgqyNlN3LQNK7nvyEsZl+BfyPL9g3qoMTCj:pYgVNlNp76EsZl+BCg3qo6Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680176776, "uuid": "3c1276a3-f0a2-403c-95cf-76c2b4833e38", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680176776, "uuid": "f8136815-3451-4148-a035-bee7036a50e8", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680176776, "uuid": "034a22c2-383b-4766-bb1b-dc0506b6c9de", "value": "mindsetters_present1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a72c15-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161223, "uuid": "9144fbbb-15f6-40c4-a63e-839e81612586", "comment": "Malware payload (AgentTesla)", "value": "3637f4e7bcb46762276ccb7465783f6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161223, "uuid": "3d98b791-1284-47c9-badc-376881d5c5b9", "comment": "Malware payload (AgentTesla)", "value": "57d148e97edd36a56b6cb5fdfae00c5224b198f9660426e68f4a0555844d803b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161223, "uuid": "0ae1dd59-4a8e-4f63-b3fc-0d2659370480", "comment": "Malware payload (AgentTesla)", "value": "74807991ba5599fa00914a41ed84809661cb2fcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161223, "uuid": "59c9f34f-d0ae-49e4-966f-14f1d09d6dc6", "comment": "Malware payload (AgentTesla)", "value": "3d36957fe188ebe50f24ecc00b46d2e721e44d6d5b9b3bc49ffe4e9441fa390044b41bb77c6896f731d60865b774174a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161223, "uuid": "139723f9-4e14-4266-a889-4bd57d0ea2a6", "value": "T1B7256ED1F190C89AE96B05F1AD7AE53024A7AD9C94A4810C56DEBF1776F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161223, "uuid": "33b72754-1851-4037-8904-e1baaaea26ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161223, "uuid": "f4ab9ee9-6712-43ce-921a-7029b2ffd7d4", "value": "12288:eeJ/sIHF6hIj9PhATYYMHdrS4w9ZKNLcMjLLluPZSJe3imOMt+:GKGYxHOMLTLKZ3imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161223, "uuid": "cdbd48b6-3f71-4e9d-a9f9-1f9e92c5e793", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161223, "uuid": "ea453b42-7167-4c0d-8c03-708ee02051d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161223, "uuid": "130eb7da-5588-4b41-8343-d6665520c162", "value": "U_sat\u0131n alma emri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1963ca7c-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196799, "uuid": "f1d4be3a-2c61-4b4b-9a0c-a918b592beaa", "comment": "Malware payload (SnakeKeylogger)", "value": "ee28db0ab6b3a364942e784877ce70b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196799, "uuid": "b4cfd78a-5583-4c97-9c54-6cd7eb1ec75e", "comment": "Malware payload (SnakeKeylogger)", "value": "57d95c45b96c1edf90baee8b8754a9846d9c552ba95dcde23ab4da2f2e95573d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196799, "uuid": "6cb76717-1d7e-4169-ae27-a8e155803027", "comment": "Malware payload (SnakeKeylogger)", "value": "3bff6f5143a641acb89828b608ac076e0e8824fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196799, "uuid": "338ecf3a-a35b-4e25-806b-a77278db24fc", "comment": "Malware payload (SnakeKeylogger)", "value": "1366fc85eeac2be70a0dc769c26c7f890d216181210c1abdc87a88fb3706e2433a3f129c54e62dee542d94b22d770e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196799, "uuid": "87e1b6e5-82b4-4e66-a94c-828f304fb074", "value": "T1B8D4014CB9B96533F9FA82BB0CA113405F3252257226CBED8CA5A0C87D677C9E5F4607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196799, "uuid": "540657c8-d26b-4562-8150-596c4df81467", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196799, "uuid": "8203eb20-6545-4b2f-9304-9274e4329b56", "value": "12288:qWIAGUowjsDn67knor1qQbv8q1c5me7QkbhTP0HmGR6X:qWNGrD67knor1AqOh1tcHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196799, "uuid": "8b8e814a-2bb5-4081-97d2-8e868268ea9c", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196799, "uuid": "d336d206-a534-46b0-8504-1500de819af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196799, "uuid": "6ff46c20-5483-4459-9f45-d0fa9b5b8739", "value": "QUOTE PRT23160 SPARES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6957735-cf2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680201868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680201868, "uuid": "f21b2677-1fba-4dcc-83b6-16142161a399", "comment": "Malware payload (AgentTesla)", "value": "6ae2ae07a768233c3713f16a433451f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680201868, "uuid": "8e190d4c-edf7-4915-9d53-14a4e22ef4b5", "comment": "Malware payload (AgentTesla)", "value": "59c042d992336e5ea4cc98b474e2fb1913cd02101d95f5c04cf0b98184f613cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680201868, "uuid": "09b2a7b4-ef50-4df7-8e69-26d3bebf93f9", "comment": "Malware payload (AgentTesla)", "value": "fbe5e4b1e2f52654bac1a427be8ba21845a55365", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680201868, "uuid": "b968d75e-ce89-4b8b-a113-789cad10e65f", "comment": "Malware payload (AgentTesla)", "value": "10c15b70964c454e4f80b803fa79f5bd1b966cdb9fe0039e12ebba3759d7d4537ab81a862b2c218c7275d50c7fd7cb9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680201868, "uuid": "2e439c7f-7821-4046-85cd-93782dd9133f", "value": "T13FF4E004F2DE8619C424B23A80D3C2BC2321DC95E965C6D6BFC9BD8FB2BAFD95815052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680201868, "uuid": "85a18bcc-2475-45ea-8b40-d7ddf4565e80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680201868, "uuid": "6150af00-bdb5-49a5-923a-9b4883fe0679", "value": "12288:X7N6XIKwkmD0hSFLi1USDDS5mvZLEib5VKYYqPiB7aLJyNt3PimOMt+yx:xRkqLgtwyLEo5VKyipkJyD3PimXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680201868, "uuid": "1e1384e6-2cc0-4490-8307-784d125752fc", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680201868, "uuid": "3e6a3c7e-481f-4056-9b05-078b4f29b460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680201868, "uuid": "8ab82199-f168-4486-af95-1b475f03400f", "value": "1030 ITEMS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdea7962-cee7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680173050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173050, "uuid": "0360863d-247a-4893-8461-a93da94f8aab", "comment": "Malware payload (RecordBreaker)", "value": "bd5f8888b3004fad8561fc64826a8068", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023pk", "colour": "#D35499", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173050, "uuid": "3cc152e3-31e5-4a14-8adb-785af1c31036", "comment": "Malware payload (RecordBreaker)", "value": "5b6ab52d344f3117aa060220148623d5c0d422f340b6e0fae1f6e78c39fa442f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023pk", "colour": "#D35499", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173050, "uuid": "444e67da-419d-49ba-9562-6acb14fb3434", "comment": "Malware payload (RecordBreaker)", "value": "64098e7d2f0545ffaadf8b0ef27997914c2ccefd", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023pk", "colour": "#D35499", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173050, "uuid": "37eefa4f-07b4-4262-a301-7b849ad299d5", "comment": "Malware payload (RecordBreaker)", "value": "c74a2b03603b375a2e87dc21b04d8b5467f05ee5011b4fdad2f1d52cad21c73dce8af1190f7a3a1559ef7fad7cc8bf1e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023pk", "colour": "#D35499", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173050, "uuid": "29bb21f6-035e-406d-bbf6-a303a64b08ff", "value": "T19577335945A52CAF6F26DD734552E6BFE42BBAF22CC23D24CCC45DCE48B18182F0A6D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173050, "uuid": "9497b754-5af5-484d-9109-8492338f8ff0", "value": "786432:kOCH5pH946OTl5weDt0+jBZQZz+uuNVvugTH7XdRYm:dEpHdeJ0KZkz+xNH7XdRYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680173050, "uuid": "7ccdc282-098d-4dbe-ad69-ce758884e87a", "value": 34025732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680173050, "uuid": "66c6aca2-863e-4ef9-a31a-5b7656694f17", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173050, "uuid": "583a030b-5e7e-4836-b4ec-454ba9aaf3a8", "value": "op\u0435nthis.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dfdf67-ce98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680139167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139167, "uuid": "480fcb53-6f20-4b26-8657-432906c5ebe9", "comment": "Malware payload (Stop)", "value": "080d5f02f7dc6a637e4685e06e67f458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139167, "uuid": "802d0d90-2e09-4c7a-8ad5-58199cc78cf0", "comment": "Malware payload (Stop)", "value": "5d13df2508447bc16a0edcb9d7a5e214cee4f7fef40564b299cbc5ca65fbacb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139167, "uuid": "05723132-132c-475f-91f9-65b59e47094d", "comment": "Malware payload (Stop)", "value": "951644e477100665a294cd172d186fdda85363f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139167, "uuid": "74c8361a-9080-430d-9c50-4a9f15c28df9", "comment": "Malware payload (Stop)", "value": "8b167065c03adf733a804c80c07600984e3e618d5c27f81802e11ea193a1462d207438e9126de9bac47b83a39b4c2ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139167, "uuid": "2bea5376-c572-485c-a493-ddea2bc760d3", "value": "T16EF41202B651C031FB5F05F58016CAB86A6A78719B658FCB33940BAF7E317D14B3A786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139167, "uuid": "7b4d6b2f-8451-4d0d-84f8-317fb22ae0bd", "value": "382fb326b0589506daf25ca040a05448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139167, "uuid": "36f8f459-2cc9-4e30-9e87-44a1a8dc0885", "value": "12288:7Mf/ZeChoOa8RFsKFTfvPClce7IYEIAwd3WFY84KZk1Q0MksWScLmyjA:7ueChA8H9Tes4nUm84QkHMkXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680139167, "uuid": "afb1f19a-aeaa-482b-ba6b-2adc619db842", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680139167, "uuid": "97176551-6980-4f02-b947-07cd5ad74459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139167, "uuid": "85bfaeb1-5e1b-4101-aaf9-55e79edabce9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccda0891-cedc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680168324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168324, "uuid": "1c1d6b0d-bf37-42d8-a77a-2dd339841da4", "comment": "Malware payload (Amadey)", "value": "c6700494aba20a68d25358fc094a81df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168324, "uuid": "333c3f8f-8b57-4a06-98ff-2185a9556a00", "comment": "Malware payload (Amadey)", "value": "5d2c2709440e2de53bd697432e99eaeb29d26f0bfd72ec0c84e0e1d3f64b1a05", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168324, "uuid": "d2c7fce1-36af-4d31-b2a8-dace1a61532c", "comment": "Malware payload (Amadey)", "value": "97438536e474863a06e74ecb1984dba490f9c905", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168324, "uuid": "e2515461-31a1-4d7c-898a-8bb9b3216074", "comment": "Malware payload (Amadey)", "value": "628bc7ae0dcafef63d3d8b547df8815344ef4c3aca4f36661f4a4f8334fe6c86d729c2f0d93ca061aa0129d66d7f15c6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168324, "uuid": "e0713b06-064c-4818-852a-3eba31659909", "value": "T1A5252353DAD91933E9B977F018FA02870B317DB09A38966733959A9B44B32C4E432737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168324, "uuid": "5afa03bd-b29e-4b53-b90f-fb7814482fea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168324, "uuid": "7ff187b0-cb47-48f9-a219-07fc6153dfae", "value": "24576:syeTXRXMfRV9eweg7yTPqH+7TEx9KvWRod:bopKewtOjY+7TExB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168324, "uuid": "afddd21c-44d4-4247-884a-d48988985c64", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168324, "uuid": "e77b2da1-e0d5-4900-a042-92dbbf9a85a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168324, "uuid": "44830a81-0919-4bb3-af2d-366dd8eec3e4", "value": "c6700494aba20a68d25358fc094a81df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a2e654-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680161280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161280, "uuid": "77f59f16-0a9b-43dc-93ca-3fb013ee580c", "comment": "Malware payload (WSHRAT)", "value": "f556c56f63b7ef7b55cc73e573dd5204", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161280, "uuid": "7571b7a9-a7df-4212-a76c-38f484b0eba2", "comment": "Malware payload (WSHRAT)", "value": "5d3e88aef97b82e659730321469ba7cea252d82389999871927f218a0dd6ac26", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161280, "uuid": "dd262a4e-5fb2-4d15-be0b-d053c0cb8418", "comment": "Malware payload (WSHRAT)", "value": "6d3f5dc51b47777a14ce4b534c0f8749c2a13771", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161280, "uuid": "e3d3118b-2191-49b9-9170-951ef972ecc5", "comment": "Malware payload (WSHRAT)", "value": "aedbbb3ea55624e6674c357bb47e40e34fee590e2a045ea1e663272334ec3f2750aa2257059b4b2c2acf5b1705df932a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161280, "uuid": "2c9e1a33-336c-4d3c-ba2c-7bc7b1aeffb6", "value": "T10B4407023E8BFA3C155F2C0465382E765F8DFE65C51951A22A496FBD83B708D137F82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161280, "uuid": "100fea3a-065d-460c-8721-fedce8d26f60", "value": "768:LqE2qlap4KjQwNCnw3CtD59yHs10wVR3wKwEBTH1dHFDE:qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161280, "uuid": "2f05e104-5e7a-4e8f-b801-8a0efdf6ec54", "value": 278106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161280, "uuid": "218a79d4-581a-44ba-b508-39395b5e71e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161280, "uuid": "38124ad2-0f63-4ba6-beab-bef122811ca1", "value": "Purcahse_Order_30032023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e33bdcb-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165078, "uuid": "d1430662-c252-4967-bc09-eb9d3d242e0d", "comment": "Malware payload (AgentTesla)", "value": "a154b7422f47a5e4353a7be627e22617", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165078, "uuid": "67ee788d-6cb5-4d7c-a473-055d9432da77", "comment": "Malware payload (AgentTesla)", "value": "5d61e25c064f0707948ef110d254508ce0d45218f7b25dab79439866e3ba3e5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165078, "uuid": "a1cb1614-137a-4c2e-b087-446bc01c5c33", "comment": "Malware payload (AgentTesla)", "value": "5ad28eb3c35a4eed170974cdc1b16654cff74087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165078, "uuid": "cabfe6aa-6955-4190-84f6-84c4b3167d09", "comment": "Malware payload (AgentTesla)", "value": "010419ff6cb10ca73f149db5315d4db02f074a0b127a25ee0678dbaa23542f8f8c75afb50ab98d6bfa9de85a19887730", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165078, "uuid": "dff8ffd7-e760-4c45-be59-ded17214bdd0", "value": "T1B0C55A243DEA5019F173EFB69FE4B9D69A6FB7733B06A41D109003860B23A41DD9253E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165078, "uuid": "8ce0c058-351d-4b8a-a03d-37abf40f22aa", "value": "24576:AopfWyN8o8lcdQTNCMRI2+aVi2rBZZof36nnjqKoe:P/SBRRMEICjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165078, "uuid": "305ade54-eb75-4cdf-ac93-d65c3f6f7201", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165078, "uuid": "9604dc83-c606-4f0c-804f-15cb1a0eb06e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165078, "uuid": "33d9412b-0ae4-4b45-9058-ddd40cdc8ebd", "value": "Quotation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9baac9-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1680158366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158366, "uuid": "f5a44442-afe0-4d3b-87a0-06f0b5d8fb44", "comment": "Malware payload (SystemBC)", "value": "c27a70d2ef4fe2df33ecb129ea7de076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158366, "uuid": "d951186c-74ed-4a79-95dc-e945110e6a2c", "comment": "Malware payload (SystemBC)", "value": "5ec8727b7a40b84c954d30774eab88e327191a6171d4881544f5486be806421d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158366, "uuid": "cc28f1c5-f6cd-485f-aced-f16c95ed18af", "comment": "Malware payload (SystemBC)", "value": "519de3af608688ea674c39b08156a629645bfb17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158366, "uuid": "1ce1718f-10d2-4457-9b97-d417a76e00b4", "comment": "Malware payload (SystemBC)", "value": "5e6f47b97c1271ecef9d476f4758a40df81a487e9c4130e9ecef39538e8fee3763c96d111adaca1f7a3e1aadcc9e756c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158366, "uuid": "accce70f-9afc-4712-a98e-4a200e23fae1", "value": "T1ABF1F826BD9280A3C32BD6FA3B4F9361D47F6A3343706509CFB25D1462B58B3D762609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158366, "uuid": "f1e3b13c-9517-4e2e-85e6-b83e9ed6d49c", "value": "c43eeea4eb37b541724563a3273bc88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158366, "uuid": "7975e8d2-cb15-4493-b1fa-6d1f0e382dd2", "value": "96:u28lqGtiuucuUa4Gn86yq/MM4odWLqtOuoVoUyHk849XXEvl7o2i4g2N9J:v8RScxa40/ZbdBpkyFi4zzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158366, "uuid": "eff6fe69-26e1-41c8-88ae-f2c9263a915f", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158366, "uuid": "aeb9ba5b-d3e6-4352-849d-3805f8880731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158366, "uuid": "5e277d12-d73e-49e2-9bfc-e029a4d1ef82", "value": "c27a70d2ef4fe2df33ecb129ea7de076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347c8072-cefc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680181812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181812, "uuid": "de95958d-fa09-462f-b51e-73697bb3373f", "comment": "Malware payload (AgentTesla)", "value": "49b64e415d7d80099fe079b57879e930", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181812, "uuid": "a804c77f-b973-4867-9566-4af9f221528c", "comment": "Malware payload (AgentTesla)", "value": "5ee727653b9e6ded021959d91650e3d23c1586b14ed1d22d84c8b3cd5f7e634a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181812, "uuid": "46d60833-4f16-4ba6-9411-4afef5043826", "comment": "Malware payload (AgentTesla)", "value": "202495e27168431afd0ce4e57eeca037acd784fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680181812, "uuid": "d6ff67c1-7c2f-4b7b-9951-59581fcf7ed2", "comment": "Malware payload (AgentTesla)", "value": "db41ef219c5d0bd655c4836198018dd182c3cbbbc8df342e6e6f6115922b92bd77cbe6416796dedb61e2e4f1bc682e78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181812, "uuid": "9c5b2030-4a22-4a66-a1b2-e9f1ac069237", "value": "T106E4015436DDC01AC666C37985F5C2B0A779CCC5EA2ACB631BC9FC87B2CE30A9521197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181812, "uuid": "5abd675a-9312-488b-8371-289a75388e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181812, "uuid": "21f22a88-3072-4ace-8f12-95a28db8a111", "value": "12288:+eJ/sIU9Thtw2th1kfQe4fiGL0c4dwuS3iQRpS2Z5RzG1edBSj81tVimOMt+E:SHwqh1kIev40c43AiQ22zRzG8dA8imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680181812, "uuid": "c104024a-0582-4bdf-9eee-93a6aa28f767", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680181812, "uuid": "5a00b174-84cb-49a0-a1fc-db79e19a3363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680181812, "uuid": "94b32cf8-4e8c-44af-a73f-0e5c285ac697", "value": "TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6830e584-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680158706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158706, "uuid": "d2b4bc94-8348-400c-a395-3d080631af05", "comment": "Malware payload", "value": "1a7143d94cd2ef458e09d4bac5c64578", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158706, "uuid": "90dd0824-c787-4f04-9ba5-3bcb21f1afb4", "comment": "Malware payload", "value": "61192618b654fd7a8728bafcfee2d36a6e3e5b5b7b6a30c545aad867585451eb", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158706, "uuid": "a2d719d2-0a1c-4600-a68c-2c4cb484cb1f", "comment": "Malware payload", "value": "ac677ed4dbabc4414aab12431f9aa73439b9a222", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158706, "uuid": "3729d7ee-cb19-49d0-aafd-fae8ff33e518", "comment": "Malware payload", "value": "a47f47226a2f4a2bc1e42bcd2490244a0421ac0e9770452b2d2d4a3420ce02f91b184ce1dfaca2cd96ce1c045c7dbd48", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158706, "uuid": "63e14bbb-970a-40ec-bc79-88cc661f19ba", "value": "T10D4402538905684BE9E3473D8ED10F28FB17D8C0A356CB5E3EA210695D1F6B3D84BA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158706, "uuid": "3dcc3437-4e46-406f-9b49-1f18d779e025", "value": "6144:d7lXIkIk+ai6laI6gRUOqa1fmioLyVmWtZxY:5aI6YF1fmYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158706, "uuid": "8efcfce2-7cba-4df1-b941-b13c25e3630d", "value": 259432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158706, "uuid": "97c0b26f-ea9b-488c-a3de-c7d6b138c8d6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158706, "uuid": "f1f18c7d-826a-4314-ad51-715bb2ae9a14", "value": "mundo-r-document-03.29.23.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2c72bb-ced0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680163201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163201, "uuid": "d03866b4-9531-4a5b-bd7d-1e4d2621bb65", "comment": "Malware payload (AgentTesla)", "value": "96cc483da15a722fb5b3f36947b63e6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163201, "uuid": "668c760a-85ec-4738-956e-6b03c195b556", "comment": "Malware payload (AgentTesla)", "value": "614f5dade069d1495b8fa995bff7907a72c2893134f3b1b88cffd9466b46be12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163201, "uuid": "b539ef3e-e921-4506-b1d6-29c448037528", "comment": "Malware payload (AgentTesla)", "value": "50c7ffd2867e5e25f6f421a25e916b2d83a96808", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163201, "uuid": "9c39cffe-08f6-4f56-86a0-1839e42c5061", "comment": "Malware payload (AgentTesla)", "value": "50b6797032f5b4c6fa2b09037933e204c555e89c3bbb2e24ec404e4e52c27742a0c003830b2de5cd0536b244570ab2ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163201, "uuid": "53da23dc-49e6-4fd4-8ce6-f05a2e7b1d0f", "value": "T1325523DFDC977A22E068FCB456B186F462F4BCB387321BD0E439BA9F05B9549C149422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163201, "uuid": "87292957-820a-43f3-a00e-9bf9dad7c007", "value": "12288:cCTc/BHzpHzVhCm10atQBMRQhqJw5I8AzS/GFL:r8xzpHB0atQIQCw1FG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163201, "uuid": "65aebb3e-a01b-45f5-8263-e5c60d5dcffb", "value": 1283947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163201, "uuid": "c7cef868-156a-4b4f-9b20-ae1fa63d7bec", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163201, "uuid": "ac2fe29a-3b75-479c-a418-187a3b955777", "value": "ARG5N5889.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f772e63-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1680158369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158369, "uuid": "cdeb1315-add6-49a4-b20c-3f1cd366256b", "comment": "Malware payload (SystemBC)", "value": "a3c0b5b15a50254c4d72412e4bff4b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158369, "uuid": "7fb7ce39-35b2-4f69-bfb1-73be4414842f", "comment": "Malware payload (SystemBC)", "value": "6151029645e6e1664322c0154bf61aca01a5576394f338fb7970dfb5785403b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158369, "uuid": "c8688960-1455-43b8-aac7-feeb462f414e", "comment": "Malware payload (SystemBC)", "value": "d4a21c77f295aaf4f9cf5d63ff699b5e51ac5f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158369, "uuid": "371ec24e-d9d8-47e8-848a-e031fc084fa6", "comment": "Malware payload (SystemBC)", "value": "63cb38fdfe94a7911f841fb23b4b34b5ac14765a96cc2d5ac48bafffd0eb4597b48d5d0a88b8025b8496b4aa9a5ab160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158369, "uuid": "0c752fc2-4481-400e-b0ef-c73ca704a73d", "value": "T1B7F1082AB9469063C327E6FA374F9358D47EA63303709909CFB25D0575B58B3CB1650D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158369, "uuid": "d8a93c4b-9c32-4f60-be4e-e67eabf6aacf", "value": "244e050a81e77998691e7f8e5062a40a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158369, "uuid": "f16528de-2697-4ca0-9d69-2ebc8f4022fc", "value": "96:kjcmO8QYts4D6x7Aa4Gn8Vk/MM4odWLqJBDeoUy7fZd9yvW92al+g7I6HS:kAT8tdOxMa4a/ZbdfrdfQXal+0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158369, "uuid": "f97a13b5-acf6-46c2-983b-10e63f041133", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158369, "uuid": "6abb637a-6845-4cf1-ae39-242c54dbcae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158369, "uuid": "5a7933d0-c292-425f-81b9-e47e0d217077", "value": "a3c0b5b15a50254c4d72412e4bff4b6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6dfdbc-ceda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680167353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167353, "uuid": "48cff7e5-fc05-4175-8838-36672c354a09", "comment": "Malware payload", "value": "7e892727e3588863b8e0c17e7916b007", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167353, "uuid": "8cdf9262-6354-4458-8eed-f591bf7c306f", "comment": "Malware payload", "value": "622311f58c79b0808257f6a330775c1bc692c72c6b615b81f5613569fd1c2e1d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167353, "uuid": "7de0365f-d6f8-4fa8-85db-ffcaec987cac", "comment": "Malware payload", "value": "3925fa7699beff7db034b37c3af483bc4bea4c6e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167353, "uuid": "e1f0ecc6-0ea6-4a1c-a6af-a375a90f75e2", "comment": "Malware payload", "value": "cf6dfdec9a088a800b6a7a861ea3a05dbb2cf84aef47fe958f6dacfa42963fd7e440905ed1ce600c713eca0415fa113e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167353, "uuid": "f87a09b7-f246-485e-aaaf-5b586b0029ac", "value": "T149226C3CD701FC16C121047DE05682F1FB2D00E7E652BA2D225A729E47616C38BDEE9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167353, "uuid": "31f6ee45-b08f-4c90-8d67-e92a2a093334", "value": "192:ScIMmtP1aIG/bslPL++uOLl+CVWBXJC0c3+e:SPXU/slT+LOLHkZC99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167353, "uuid": "a322316e-aa3d-4d59-9929-279c1c00a508", "value": 10408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167353, "uuid": "2442beb1-b706-4e24-b2ea-f157ec27b8ca", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167353, "uuid": "6cab6d17-ed08-45e2-a2ea-39c4202dd130", "value": "Invoice 0629.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8307280a-cebf-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680155745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155745, "uuid": "119aa158-aef5-4ad6-95ff-75cfb981a441", "comment": "Malware payload (QuasarRAT)", "value": "0be9fad29e0b27d2b418265817618d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Qussar", "colour": "#61EE73", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155745, "uuid": "f5cf22e8-d211-41e1-beed-4264635169b6", "comment": "Malware payload (QuasarRAT)", "value": "6270216a0917518e451b68a50f0cba330771b22429c7b7795465c45688951740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Qussar", "colour": "#61EE73", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155745, "uuid": "49368927-bc28-4c63-9d0d-51b5c87b0489", "comment": "Malware payload (QuasarRAT)", "value": "3ceab68ab5de6d3542ec2a574dfaa906f4e3b611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Qussar", "colour": "#61EE73", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155745, "uuid": "841b117a-262b-46ae-92a8-d637cb2998cc", "comment": "Malware payload (QuasarRAT)", "value": "0234ad3e915130188d98a1a23880ee2b467b495bd6a7a9e3614f07b938444f23ccf1094d5a02fdc9c2f387f8e5f84a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Qussar", "colour": "#61EE73", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155745, "uuid": "6a9dc90b-46d7-4e70-87f2-f93aad9ef802", "value": "T151E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155745, "uuid": "4020202b-a471-493d-9d56-25e750b5c156", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155745, "uuid": "c7971d21-aaa6-445b-b038-4b8ab8ed6a8f", "value": "49152:3vtt62XlaSFNWPjljiFa2RoUYI0rRJ6IbR3LoGdjTHHB72eh2NT:3vP62XlaSFNWPjljiFXRoUYI0rRJ6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680155745, "uuid": "0015d9d2-e917-4b8c-b4eb-13171be7ab4e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680155745, "uuid": "68ed3a22-eb77-4d5b-aeca-b442465f1f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155745, "uuid": "3fcc4d8e-0c85-4c3f-9f82-0a3da08a2808", "value": "fhjgfutdcuidudxoxixixyudtuddctuctct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49af6238-cf0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GurcuStealer)", "timestamp": 1680188290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188290, "uuid": "f2b86caa-5f24-447a-a3bb-ae8344916651", "comment": "Malware payload (GurcuStealer)", "value": "5a1a37fb68eeb445df8c647dab8af952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188290, "uuid": "919c2dec-afed-4465-9b5d-9fb634524c2d", "comment": "Malware payload (GurcuStealer)", "value": "631d7e6e0d9b03928ea24c0f846e3aad741bd675b8837035e8bdc028dc25fc98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188290, "uuid": "82ea0971-e22d-496c-a01f-38d18c83f47e", "comment": "Malware payload (GurcuStealer)", "value": "95f2c1a9ae32d39ed616d2007bbcf6f74feba18f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188290, "uuid": "ca2e5b71-6820-46c7-a390-c83883adc6d1", "comment": "Malware payload (GurcuStealer)", "value": "70821aa3fc6270dee510191c29e23d8474bcec0371b6e3980672b87a953ef5eef757ef4faae74915df66946d8675d261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188290, "uuid": "27106fd5-1a24-41d5-9f0c-75260ba20b87", "value": "T10823A451FD84892CD5899271C86E43404B7BAF9B6F03DBCD885DE7459BCAAC4CA87B0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188290, "uuid": "e6679b1e-28cc-4fef-b679-d88ace41158b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188290, "uuid": "dcdc1e85-30c5-47c5-bb35-4ec0bf7e36fc", "value": "768:4g/hgfJYO9KqosayemfSbvZ5l9GCAPk2/PWC/cEnUSBQtP9:R/hgGO9KrHmKbvtelRJnUSBiP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188290, "uuid": "ca872b1b-1f98-4a10-b57e-e7b194fb1126", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188290, "uuid": "d1628728-2be2-437e-9423-3046aa6ee4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188290, "uuid": "76259fea-2465-46e4-82dc-767f69e8fa86", "value": "5a1a37fb68eeb445df8c647dab8af952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25f0ea3-cf52-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680219041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219041, "uuid": "f30ce24d-9151-4f5c-a954-46b0d13903e9", "comment": "Malware payload (Mirai)", "value": "f5393ce6ced9f7d6ccc56b4b93ef7dbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219041, "uuid": "0a40d72d-0387-4331-a7aa-3728ad8f9465", "comment": "Malware payload (Mirai)", "value": "63c24599241b7c44f6a66bb7466183ee64fd65aa1970772015ca450a5ee8948e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219041, "uuid": "a52d5f50-aba4-4d81-90fb-d2dc78164c36", "comment": "Malware payload (Mirai)", "value": "06bb58aa55f5d8c88712da59e1a5c53eb8074f7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219041, "uuid": "9dcf3596-09c7-4829-8533-03991d607d7c", "comment": "Malware payload (Mirai)", "value": "5826b0840980f0c19d4b9891853d8715dabd6f0dae264936d6ec3e96101958dac02bd207897488706b4f76899232cba2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219041, "uuid": "26d5fd6d-cf1b-4764-a47c-1418f7029880", "value": "T153536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219041, "uuid": "1cfbaada-3f94-4ce6-b1ab-bcaa1146a915", "value": "1536:Z7qARubgzY/bEJyzRcpU80LDHhklv4JQC9DSW:NP+eY/bEJVoXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219041, "uuid": "bfa3a405-8e85-45f7-907b-60308eacfb84", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219041, "uuid": "6bb68255-2fbe-4106-9df4-25ef3c27ea3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219041, "uuid": "6df56d57-2ac3-4aca-b29f-5d57e5b8316b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58c9410-cedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680168687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168687, "uuid": "7d21e1f8-dcf3-4f56-bf2a-89ae6346596c", "comment": "Malware payload (AgentTesla)", "value": "7e67408c84c44ee8696d5d62653518b2", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168687, "uuid": "21d398c9-46b5-41e8-a69c-0c1ec1eb8cfd", "comment": "Malware payload (AgentTesla)", "value": "65ba72467800747bde878148d464e6e5c66ab9667a963969b3a18e7bd5a58505", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168687, "uuid": "ba3448c4-491e-474f-ba6b-caa4359db5ee", "comment": "Malware payload (AgentTesla)", "value": "e02a9f892a97cc9a5bb5506d5886aa1c524df525", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168687, "uuid": "74fe1813-d0d6-4662-9b49-7745cec80093", "comment": "Malware payload (AgentTesla)", "value": "f8fb5fd70631fa718bdaa34b7f6403644b82b1caea4cb23777c772d77125e6a8b4fc590d11563d205ebf355372a792bd", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168687, "uuid": "451e8af2-75c2-4a05-a30e-a7fdb07bdd44", "value": "T160B4232A70640B9E9912870544360CBF85F521D185783E87FA6CD9DA6F2399C26F2FF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168687, "uuid": "d3d2941b-47ef-4783-8616-6ffabce2102d", "value": "12288:ihvdYBO/tFN6RqAdgvJjoULRLdFNVzMObLoTF2FEZ2ZVE9:ifYBOE3CvJjoULRxFNaObcTF2e2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168687, "uuid": "992c181b-7bc5-4429-8f21-dc2f32bb6dac", "value": 536324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168687, "uuid": "2e1f7e49-c412-40ac-af3d-cd66e224f30e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168687, "uuid": "59da83f6-2369-415a-a224-2e5c0f486a32", "value": "shipment 04629673893.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12da16f1-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196788, "uuid": "a1c1bc09-2189-49eb-8a0e-6c39d4ac141c", "comment": "Malware payload (SnakeKeylogger)", "value": "8e127f463a68ba2adad3ffb8970b22d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196788, "uuid": "3197427d-9cd5-4548-b445-d171ce07b5b2", "comment": "Malware payload (SnakeKeylogger)", "value": "6651fc9d40430503d651012b74149b5b99f2a6b758ee59498a21b7592722a3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196788, "uuid": "60c71bb6-146e-4c49-bcad-e2c2115a87d8", "comment": "Malware payload (SnakeKeylogger)", "value": "85c08c595fb65001f936d517c3e2ce9f8ee0b44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196788, "uuid": "85576d06-8e2d-4e09-bcff-baac720b8d09", "comment": "Malware payload (SnakeKeylogger)", "value": "70f6ef361d120414b813ed2c00c6d1e668356178cba9fc98ab199ed4487f88381b071f327222f6158ee655144bd7a1e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196788, "uuid": "546c2c13-7e62-442b-bcf3-5650278379e4", "value": "T137D4025432DDD12AC6A69B3D84F4C1B0637DCCC9EA6ACB574FCABC87B2CE3065121196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196788, "uuid": "1d18766e-adfb-4dfd-b9b2-246b33f64b2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196788, "uuid": "ac805a34-2809-4068-8ad7-ef0d4281b5e4", "value": "12288:heJ/sIKtYhd22H/buYOfW+5nnzdjexYlLkf8uOvflpTrZuwAW4imOMt+l:ArDfyY1OnzdjJ4lOVpTrsW4imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196788, "uuid": "ed111497-a561-4ecb-99d0-b877eb42eea2", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196788, "uuid": "4616cd41-9208-4d6f-9cc7-33f742d04ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196788, "uuid": "ac09942f-865c-4fac-88a0-a0bd4003cd3a", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbacd67c-ce92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680136539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136539, "uuid": "2d29b5ba-01f7-4ee2-bc40-441bdff1abff", "comment": "Malware payload (Smoke Loader)", "value": "3d8f2e2ad6cde3e6855c91724ea27559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136539, "uuid": "3a7b98d4-9113-4030-b634-b2b5343c7fe6", "comment": "Malware payload (Smoke Loader)", "value": "672e4f8b2b2eb5c28c833ce849771913314bea5d700dcf6323e219e848ed2e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136539, "uuid": "36dec86e-278a-4fc2-83f7-57dcba4bd668", "comment": "Malware payload (Smoke Loader)", "value": "e69690b6f06828b1da990b7bd3873870b650a410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136539, "uuid": "a6fad066-c3f5-44ba-8d80-d3bfdc342ba1", "comment": "Malware payload (Smoke Loader)", "value": "6f8468e3f4ce7db54bc58f4ada05040308c35e12d9c52b4cb42a5131ef0994bf417f37bfebedef40aedbe1a5af739cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136539, "uuid": "0171eaa1-09f1-46fd-becf-57e620bcbf52", "value": "T19C44D0227691C472E95B25794803DBB48A3ABC719F25BADB37940AFE4E303D18F35346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136539, "uuid": "46771b4d-68c5-4ed7-bf47-f88ce5b5d435", "value": "382fb326b0589506daf25ca040a05448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136539, "uuid": "a331f492-6032-4f0a-baa7-a62d2c0fa409", "value": "6144:ijnhJXze5nNNLygcQAnS9wkQNZoO3in8f6T:shJje5nNNugcQASi1o+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136539, "uuid": "436c9f95-9e1b-48f0-b456-9c9fccaa7e64", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136539, "uuid": "b6eebbee-5eca-460d-9767-e708a3104eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136539, "uuid": "e334cad6-dc63-4d8e-9e47-e3cc9f0f34f3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6bafde-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680161265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161265, "uuid": "f172536a-51d2-4e0d-8aa4-f1de7f6ae3e9", "comment": "Malware payload", "value": "ba2879e8328b90fc0c5e0d0eb72d76a5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161265, "uuid": "6276d51c-3d5b-482c-9777-0e2c2657e324", "comment": "Malware payload", "value": "6774675c4a91d09ed527286d342c9cc8fd2e6ffd370d8ce584168a4c7569a20e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161265, "uuid": "047aca45-edc9-457c-9d82-351e905cb7b5", "comment": "Malware payload", "value": "8cdd03dd56a9c7b707287280eb1db980add25469", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161265, "uuid": "26ce96e6-85ed-4c53-943e-f535562b1ab4", "comment": "Malware payload", "value": "350c48797b0b5f36213453672049599e3b2c8b075393426db0d97ac8dba6d270d9b1ad891ca951ff81273e93a49be6c9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161265, "uuid": "b953e4e2-f59d-4a37-acd0-d08fa4727015", "value": "T16EE4E0E7FCE05F3DD303B2394D158C23E60D9CFA9CD9D4462673284A88E59496BC5B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161265, "uuid": "555c4032-ecf5-4182-bfec-5a0cef9bd577", "value": "12288:+a48i+7aE+7CvpFVMqvDH2Bwxxil7SDLVLgagZxmcMeWB3vJ918z9p:+a48iYmuMqVSugagLmZPZJ9qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161265, "uuid": "e563eeb1-53bf-4b3f-9e34-e84528234c49", "value": 685277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161265, "uuid": "4d816ad5-cfc8-41d9-8d5b-b3b558ad9a7a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161265, "uuid": "18a64372-db99-4ae9-9a12-2d806631d3f0", "value": "INV38509216.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf39a179-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680198366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198366, "uuid": "e68e3f8d-3671-4ecd-822e-cad7aaafd7fa", "comment": "Malware payload (AgentTesla)", "value": "5e165a00cd809f7605073d7c40eabc8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198366, "uuid": "84ea1def-9e29-498e-a1d7-c32c8899516a", "comment": "Malware payload (AgentTesla)", "value": "6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198366, "uuid": "527657bb-0ab2-4bd6-9fc1-78697a2f3a39", "comment": "Malware payload (AgentTesla)", "value": "7d473fb5e61d0cfbbd168c88b8f9a85e83a0a125", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198366, "uuid": "f2d7395c-dcdf-4fc6-80bf-b55bafad6bd4", "comment": "Malware payload (AgentTesla)", "value": "12b1cdeec6322826ed15f0156ea7c1726b6a44e7261be1f960d6a593edb26ab5f9e579420122d6bb78c39662ad43a5e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198366, "uuid": "566a9e9e-236a-4abb-b69c-83f4a082ae44", "value": "T192E401543BDCC208D02AD77E92E0D1B0A3BADD94EA62C75B0FC9BC87B39E7564561087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198366, "uuid": "59343c34-1219-4f5b-a7b3-9c7dccef2439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198366, "uuid": "a8284a85-f4c4-4576-9b4d-e439088cc562", "value": "12288:SvCgELbEubK0iEvLnfZka63QGX12G8/CfRXzlmqdTrtp2oimOMt+5:STOG0iQnfn6AGX4PCflzQyttimXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198366, "uuid": "2ab26a4e-7f6c-4d48-b516-02f4376a2af0", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198366, "uuid": "dbfcb78b-fd16-4eb7-8e7d-ab172313f81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198366, "uuid": "f28a2771-24b5-49d5-84a7-1d65bf33a32c", "value": "Hesap hareketleriniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820fe269-ced3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680164333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164333, "uuid": "c31753a5-3f56-47c7-bd7b-972075835a8d", "comment": "Malware payload (RedLineStealer)", "value": "cca00444b1426e7e30390972454569ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164333, "uuid": "57085a45-9075-40f8-9db3-4dba53939b28", "comment": "Malware payload (RedLineStealer)", "value": "691d8e442203738d896dedc82758d373c732935141729662a77c501589e34fe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164333, "uuid": "91b95586-a4d3-4900-aeaa-e7993c38a998", "comment": "Malware payload (RedLineStealer)", "value": "93244f2c45d86d0daed7634d455d7a038e1b265a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164333, "uuid": "ace2e396-ee00-457e-8009-ff3455ad90b0", "comment": "Malware payload (RedLineStealer)", "value": "a3718f87081c6700a418e6999fff357edea43809f058686bfcb33a35291d7502740de465c940084f784e7ffde85cb24f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164333, "uuid": "1f60f2ce-82e0-4c80-a476-7b9023e42ccb", "value": "T1F5252342BADCA472CC78177015FB12C7273ABC855EB4876A3797C95A0EB3988E03175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164333, "uuid": "56146842-cfbe-4747-b48e-5e6c01e38e39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164333, "uuid": "c067c422-1a63-4f27-a3d4-ab8597fa3078", "value": "24576:ByxN/S6Sn1Xy6FFu775JQmdIFc8gY8ccr8twP/3c:0xG1LFFGfic8enQqPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680164333, "uuid": "06f0c3b9-9578-46c3-97df-9e3e28c6240e", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680164333, "uuid": "b16f9157-07ac-440d-9adb-fdec14278b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164333, "uuid": "f36f85d8-bea4-40de-b530-9b774b45ed72", "value": "cca00444b1426e7e30390972454569ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852ff73b-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680159184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159184, "uuid": "8a4135cc-5b0b-456e-b102-73d1083a46eb", "comment": "Malware payload (AgentTesla)", "value": "b72e804379616200f92737c1fcacc9df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159184, "uuid": "b02499c9-0e58-49ac-b6f1-357cc9d0736a", "comment": "Malware payload (AgentTesla)", "value": "6ab23b6c600f2f84df0442f21ba552973126809d9b26557d2f815e60c135517a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159184, "uuid": "a895dd95-8085-48c7-bc39-19df165faf28", "comment": "Malware payload (AgentTesla)", "value": "ba521b7ad8c14bc0072f70541ef71d74130b7f0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159184, "uuid": "c0d6f1b9-ef29-4561-8b3e-e0e4aa229b04", "comment": "Malware payload (AgentTesla)", "value": "aa9e9befc4fdc9074defcd4d206bd36e93db1f8cbfb1f86bb49d0d18d6d1c80ddfcbaf790f90a3f59f43fe28e3404a15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159184, "uuid": "daed4025-b0ac-4c4a-b068-c91d5929eb62", "value": "T1B4259B5DE1C072FBD62347B685D0E733A22FEED5061299CCD9E42DE7B1FB608091A216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159184, "uuid": "34ef41cd-64de-478a-aed0-f76fd03d56d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159184, "uuid": "eabaa5e0-49b4-4606-a6e4-858fbc54a8a2", "value": "24576:xy12zVZ97so6qZ4pgHNaPtLw3yOAQqP2:xyAR37f6qZOkutMCOAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159184, "uuid": "6ae361d1-3c52-44fd-8c26-3a40112677c1", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159184, "uuid": "038e467a-a238-4af8-9a74-f964981d3236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159184, "uuid": "159ee153-7aea-48f5-86f3-35ad7ef8a431", "value": "#985638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccc12e6-ced1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680163653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163653, "uuid": "511290ba-f5eb-43ac-bdc0-c75dad3c0c2b", "comment": "Malware payload (AgentTesla)", "value": "70f9debac6e733f89311441f1e76d20c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163653, "uuid": "e23011ac-02c2-4711-b3d2-9004f9b92d93", "comment": "Malware payload (AgentTesla)", "value": "6af049a58c2305e04f612698a55fba678584d4d878116ed2ee3163f32c257ac4", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163653, "uuid": "646ef4ce-6764-487b-b29e-e9177cfe3dce", "comment": "Malware payload (AgentTesla)", "value": "417f11b0bd60af176a01d061b6e3ad15ad5b953e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163653, "uuid": "978f9386-451e-4ad1-9a68-f7f900157cee", "comment": "Malware payload (AgentTesla)", "value": "1102635f567b79cd92bb503a86a8bd6663e42ec00a8cd18f8dda68ddd636cc16dc7bb22ecc37b2995c65f2d3e3695105", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163653, "uuid": "cfb9bba4-0077-4c04-9dae-fb1be0555563", "value": "T1DBE3129E2044E9EBD5522579025FF8E913C38E2A2ABDE70D16A0D5BC535F70E6F08F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163653, "uuid": "6b5988e7-92b6-4d9a-a622-1a887a3a6411", "value": "3072:28MzDbnCWshhqNzE75DDxzKk7KKadcy4N/i0t6zTu3nLytEXfo91k0:9ie/WEF3x+kelca0tQu3n++Q91J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163653, "uuid": "f39f4328-3fad-4802-a539-c264f4ceefe8", "value": 150665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163653, "uuid": "70d8c283-e050-48bd-91ab-81c1b80906b0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163653, "uuid": "afc3206e-eddf-4028-9abb-1f0d455cf2d0", "value": "Commande nr220489 E833080.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc527e8-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680161162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161162, "uuid": "4baffc5b-d50a-42bb-a2f1-3775ea766a51", "comment": "Malware payload (GuLoader)", "value": "57f282205cc0abd33d339ccedf0df2f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161162, "uuid": "9afd15a6-8b78-4736-8aac-756d5e59ad51", "comment": "Malware payload (GuLoader)", "value": "6b33dcd29a3bddb0574c50b604db51b808c0909df8beeb575fea8979ce55dd49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161162, "uuid": "4031a57c-db2b-4b0c-8fc3-91f00f41280e", "comment": "Malware payload (GuLoader)", "value": "1cf7ba24d1157a1b4add218db224d34c2bb416dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161162, "uuid": "9dcce781-952f-4989-acb7-7bf1ebbc75ed", "comment": "Malware payload (GuLoader)", "value": "9f8f1390140abaa53dd66e2192986c3cad629787e3200fdc39e858cd7ad417b28f6a71c99a352bd9ab5575f2fddd21c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161162, "uuid": "e9103622-6777-40fc-b16a-9efe26f4da7b", "value": "T119D408F9B224C1AAE2BB46F17D2B686421F7ACAD98D0421D26BDB71C05B271111DFD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161162, "uuid": "836e15ce-bffd-4609-bd04-330d72c0c8d8", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161162, "uuid": "7af7fb9b-2a55-485d-b00e-63c64f78a30e", "value": "6144:sMm4CCHM4NL26fgvHOg3UXy5bpBUWwVl57DDCu96qvjIegLl3:sMwg/NL26fgvHOFyrKxl7vCM6qbIeal3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161162, "uuid": "f17e20f4-9e7f-4648-94af-c857624cf46b", "value": 647517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161162, "uuid": "7f7e1b37-fa3b-4e8a-bfd4-a3b496f71b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161162, "uuid": "b827d9e0-559c-4c57-9eda-2034f62de487", "value": "20230328.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f308ecbd-cec2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680157221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157221, "uuid": "6e6ea8b6-da57-4906-964f-2509e20a619b", "comment": "Malware payload (RedLineStealer)", "value": "cae6c9ec40436b9e2ec437d76a162e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157221, "uuid": "17b3be4e-9384-4dab-98ab-3af044f78545", "comment": "Malware payload (RedLineStealer)", "value": "6b714b30cc6c201008579d9cd58f051689d9bd687e3137ec1b462974aa4eaddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157221, "uuid": "ba9e1955-8d0b-4020-84a5-c04fa3d58e82", "comment": "Malware payload (RedLineStealer)", "value": "b7f357ceb28cd25c81b1f9832bdf772fadac90bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157221, "uuid": "dc8f5026-7262-4b7c-8539-1e9c4df44f6f", "comment": "Malware payload (RedLineStealer)", "value": "b686454dd04f8c8de41ae98d615937776bae8979ea9be820c0eb2cfb9ba2e82f90dbfcffe7852cdaa0081dc80f42fe3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157221, "uuid": "e89adaea-4eb8-47e2-9cb2-1af68b7a56a6", "value": "T11B44D0127AD1C4B2E91B41798812CBB4AA3BB8704F5186DB3B8436BE5D347D1CE7E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157221, "uuid": "7c8e9a5c-1782-4863-ad71-d727cdb6d500", "value": "fde2d3c5c6b5080c428e56f6f2289988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157221, "uuid": "6983863c-0be4-474f-8392-ab3c059430bc", "value": "6144:VpTyXdhIvLVfft8V/MKDfXqLIml1q1KyS:VwXdGv5f+yKDfXwP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157221, "uuid": "538fb7d2-8e1c-4fa3-8385-71d020252153", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157221, "uuid": "688200b8-64ff-437a-bce1-caef33d5b570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157221, "uuid": "04fbc591-18a5-4ce0-8d3e-4e5cf2c10985", "value": "cae6c9ec40436b9e2ec437d76a162e2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ecfb8c-ce96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680138105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138105, "uuid": "b6457df6-54b9-4176-b78f-e2a7af910852", "comment": "Malware payload (Stop)", "value": "d6101261ce3fe1bacf8327849fd1214f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138105, "uuid": "5cc1a075-ba23-4cd5-98c8-f88b3b514c4f", "comment": "Malware payload (Stop)", "value": "6bb90befd2e45a6caaa4ccd0b47dfa0453b28f0b89c62f78c628e1936fdcb49a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138105, "uuid": "c685c337-4e85-4b2b-986f-c390127c8640", "comment": "Malware payload (Stop)", "value": "d05f38482d73fc5d92ee999bde4d7b3480bc3d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138105, "uuid": "95237df0-a9b3-4989-bdf3-8f33349af658", "comment": "Malware payload (Stop)", "value": "7455fdeb0f8a774d2be32f5f0d26bb3c0520a68c937b84d4e1378723a9834c4f6ff0ab8c034329a084bcd44b0d560fc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138105, "uuid": "3c9ca225-2daa-4fdf-815d-e1853c1d912e", "value": "T1CAF41212B792D472C51A11BD4410DA745E3EBDB4AB6ACECB374847BF1E303C19A7632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138105, "uuid": "87120d81-807a-457d-8c20-bcdcdc307564", "value": "fde2d3c5c6b5080c428e56f6f2289988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138105, "uuid": "75e84c46-1294-4da2-b4d4-214a7a19371f", "value": "12288:9lfFXsJiB9vELsqQoHq/CZaIi/f25N8raOT9pJZA2VTxXLB42d14Ern04jfQ3Qf7:9lyCosD+q/CXLN8rdpJ37XHPtKLv4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680138105, "uuid": "748749cd-d81b-4a57-b18e-66025b920472", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680138105, "uuid": "dfccb127-2a7b-472a-a23b-995bc317d06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138105, "uuid": "1aad920f-64ba-4477-bde0-7c007d18f4c4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d54e4ce-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680160916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160916, "uuid": "6e02e60d-186a-418f-a308-02a4d36bc056", "comment": "Malware payload", "value": "acfbc6c59006cabeaa982c5cf3b2975c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160916, "uuid": "b4c68f23-edc4-4791-8968-4c7e275923e4", "comment": "Malware payload", "value": "6bf9d07d639521837124af321555cbcdc5997fead136195aed97e2744e4120b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160916, "uuid": "ccf0f104-ab6a-4222-9f86-7fd441994316", "comment": "Malware payload", "value": "03ef87ee97fb810723f8cf284c09755c08822eb0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160916, "uuid": "32fb6f10-f644-41a5-b2d2-604a78cf1de4", "comment": "Malware payload", "value": "cb0ed077ec2d0e8dfbd5150ef7e3d3971a4a9397f3fb73d4ab760a8b9b7593ef79b9ade73295ef8b96573cc7bce59ef1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160916, "uuid": "66aa904a-dffa-47e2-bf02-bf1ce2d06bf1", "value": "T1F8A35B9A77E74B12C97C05B2C8D3457803B7DB4F6573EB063A9001A74F123B58AA7AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160916, "uuid": "1dfd4800-8ff6-4ec6-98c1-4ca22dfcc773", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160916, "uuid": "46dfeeea-0ad4-43ab-b5ec-fd2b023a9309", "value": "1536:xmyG7q0cIx4AVcw3AP5ofyOGuwG1kpXkPm7i5BihXW2CfbZoJ:xmySq09xlc9P5o6OGuwvpXkeOSW2ubm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160916, "uuid": "24195763-69d7-4220-962d-973ab6165c99", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160916, "uuid": "f4981c79-c4ba-4438-b541-26ebd87c14c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160916, "uuid": "a7d31e8b-99e1-4dd2-bae2-51d83af89ab8", "value": "stage1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c70fc1-cf4b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680215778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215778, "uuid": "55178cca-8f86-441f-a835-97594ea2b39b", "comment": "Malware payload", "value": "f5bb930c013a93d9bfb503cb5a1a03c7", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215778, "uuid": "2aea68b4-a35d-40dc-b26d-194f7529e36e", "comment": "Malware payload", "value": "6c95be19ffcab9d2c497656a77b94d118e4ab34342bf98fb1b4b100547667dc3", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215778, "uuid": "b405eda8-67dd-4fa6-b2d6-869e21db4bc3", "comment": "Malware payload", "value": "e82aee2dc8ee7e27189b2d787dc12a726edd6cee", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215778, "uuid": "88396b5e-7176-4ead-a12a-871602b5d5f2", "comment": "Malware payload", "value": "d2a8e893cced66f4bdca092f8cf5a44b7a608ff36ad59699144d64598a1c99c475857e03b180112d7368038ccba327aa", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680215778, "uuid": "7453179e-5623-4e53-95bd-ce79f7b33a08", "value": "T15E6512B233409C42E5A1327F0DA2D27567F69D49858E470732DC7E0FFFA22E25E1964A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680215778, "uuid": "efb2beec-e99a-4119-8695-861da49d025b", "value": "24576:TuxnYgntESITi9qOEzbPDzse2IWZDNjpg2IRezT:6hrtELTi4OI0z9lNjp8Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680215778, "uuid": "4b1b7f44-a216-46cc-b559-8067238734fd", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680215778, "uuid": "83b15ade-82e5-4193-a5c0-01f56a72d1fb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680215778, "uuid": "f264260e-54d8-41b8-b4a4-64d7dcf4d495", "value": "nrecibo %281%29.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5067cd-cee3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680171004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171004, "uuid": "0a77b50b-3a5e-47e2-b058-6b884a9ff81b", "comment": "Malware payload (GuLoader)", "value": "820b5569273cc225166499d614ac1afc", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171004, "uuid": "ccfe3036-ff8d-42b1-b79e-f1f84c0a6ae7", "comment": "Malware payload (GuLoader)", "value": "6db1572c5bda8763369cd8f7f5fd29092c51ab1d1a435d3c581cfc83fa84806c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171004, "uuid": "a43e07be-75b9-45e1-874d-f5c3b66da816", "comment": "Malware payload (GuLoader)", "value": "76bd74dbe93fec99d46619218d1809e01e1080e9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171004, "uuid": "b1bd7046-865d-4cbd-b31b-39efccd1411a", "comment": "Malware payload (GuLoader)", "value": "1870ec8fcb451ec574743600367f056c2e6d6c9ec1759cff0aaf00f3aa04ae0e12bccf44aa51cca81d74d588ac8e2b02", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171004, "uuid": "5828e433-f6b4-4f30-b3e9-1930888cc684", "value": "T1F965127233509C42E5B1327F0EA6E1396BE19E5A418D530632CCBE0FFEA63D25D1964A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171004, "uuid": "a4e07fe1-98c2-43fd-87d6-b331399a3267", "value": "24576:puxnYTWRWSxVZqOEzbPDzse2IWZDNjpg2IRezT:ch3W8ZqOI0z9lNjp8Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680171004, "uuid": "a2f96171-6769-4db4-a3b6-f90b9505286e", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680171004, "uuid": "5f000615-39f6-4a92-b34c-4893f5d41fbd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171004, "uuid": "7e52b51a-93ae-439f-811a-fd653d65aea7", "value": "820b5569273cc225166499d614ac1afc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e7f0f2-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170881, "uuid": "03afb912-06c9-4491-8012-b50a027794e7", "comment": "Malware payload (Mirai)", "value": "d3f9812547a775bc66b3d39a13d03bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170881, "uuid": "68bd322d-d770-4d90-bce3-55bbb53b5ee7", "comment": "Malware payload (Mirai)", "value": "6dbb738f209e50d753a3240e3e8550b355026d833e24a3d4341d289fc5fdef1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170881, "uuid": "db228060-13ac-4ad5-8cfb-1afca7efe395", "comment": "Malware payload (Mirai)", "value": "d2d1d036cc59dc2eb17398e09ac8284cbd5cd93f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170881, "uuid": "c809b3d1-dde8-4618-a220-b46454721321", "comment": "Malware payload (Mirai)", "value": "134d19cfb15856e8df58b20590d700d6f3af9c1c4e328d43bc225b87b11ff0556a98cc4d9585d04d5e78957353bd04d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170881, "uuid": "53e60d7e-b9f4-4bd3-8ee7-3149ef38cd1b", "value": "T1ED83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170881, "uuid": "8d30e75e-dcca-41be-99d0-5c5ecb41bc1a", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTK7ZDYovZ73x/nL8y8Qr:Rakdn2Eo3ePu5GTKRYo99Be037Wg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170881, "uuid": "2f2796be-1c5b-471d-a4d0-1e5083351f8d", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170881, "uuid": "fdbbfbde-44f5-44f8-a751-ba44eff5eaec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170881, "uuid": "7780a5d2-daeb-4f64-bff5-d3fce9f1e61f", "value": "d3f9812547a775bc66b3d39a13d03bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d96015b-cec8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680159440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159440, "uuid": "71a579b1-20f0-44ed-80e9-14d724751d5c", "comment": "Malware payload", "value": "8e7f14deb38489a62ae9486534542dd2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159440, "uuid": "ba765080-dd73-4393-bb8a-d03999c3ba78", "comment": "Malware payload", "value": "6ddb6746cee09a46fa029ff420a94524169b8eb6f3915166cd58885dc78a25e4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159440, "uuid": "969a3b62-b66e-47af-b409-934d387772e4", "comment": "Malware payload", "value": "d9147978cc8b1c66ce8e24e82906521274990170", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159440, "uuid": "c6464754-299e-4653-b8f7-53a7d34d667a", "comment": "Malware payload", "value": "5ed9c03cbf3c17a65120025b191495e9ca5da99c02f5cd21df5458885bfd5916d400f8eecb7c2ce760f8ab8e89ef9546", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159440, "uuid": "685714f3-c85d-4c17-8d60-5c97f462a3c9", "value": "T1B6E4237B93C85CA8C7958CFA1C188B7A459D787C066AC5D204BC4E6CF6B33C862E63D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159440, "uuid": "46c35fe6-bfe2-4a76-aea0-4adcaa01c4ab", "value": "12288:bEk+Bw55hJUr2nDTYd5vBXlTLifCSVwjcEDQZNK/+PdPbSgEGLyKW2oq:oa5/JUr2n3Q5vBXRmKSwjQZ8ECQbdoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159440, "uuid": "1043db01-f64c-491b-985f-8e4fc2839b99", "value": 677353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159440, "uuid": "ed5aec7b-e055-4145-864d-056f402bf10e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159440, "uuid": "0396a122-d927-4707-a2a3-ed01589dbc6c", "value": "Invoice & Packing List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252bbbb6-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680159023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159023, "uuid": "cfed1b41-f2a9-4635-b3f9-4aeb1ba7cc78", "comment": "Malware payload", "value": "cfc62db8aedaabb744696b70b9ffe5b0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159023, "uuid": "c362c77a-f3c5-4f80-b314-8b8414576dcd", "comment": "Malware payload", "value": "6df39836da496a469071cb5ad011593a0bffdf94337889de0e8611eac8a58359", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159023, "uuid": "4447ed72-5a7a-4bfa-96d6-33dadbd6fa78", "comment": "Malware payload", "value": "e17e7e60bfdb3edd93c8e7c02d1ac1521d2b1dc6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159023, "uuid": "64e2aade-dae5-41c4-ac88-4d3110669c46", "comment": "Malware payload", "value": "47abcb4f37f0e9680ea8f23b0ef62e01951036496bcbf2b3a80bfb37873c3f38f82d69fc1bf0cb43223788b23e4c4139", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159023, "uuid": "969651cb-22ea-456a-a4de-3030609299ef", "value": "T10EF4236988B4841FB10C88A8C6096154EEDE956F3F9E2D5031B389B6F7933472EDF50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159023, "uuid": "268e74fb-e4a9-4f9b-a38e-db357998e3e3", "value": "12288:h0OoYg1pA72opbMO0QBGiWkayWeUTC6dla/DLEEz07kMm5MXs7dSGZtZGiJLq:hbod1pA72oN9pg+OU7LEW3DaISAYIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159023, "uuid": "34b64bfe-1071-43f7-8cbb-e4e1481d6eca", "value": 763628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159023, "uuid": "b9f6201b-8524-4547-b8b1-03b8772d6845", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159023, "uuid": "55153aff-b624-4f64-b320-d7dbffe06384", "value": "doc_orden de ##compra.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb877d5-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680158933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158933, "uuid": "5667c3a2-13cf-4f2a-8e71-0309e2425beb", "comment": "Malware payload (RedLineStealer)", "value": "99e2a8081fce305dd7c3919ee4cfd687", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158933, "uuid": "cf755a4d-658a-41d9-a3b5-0abf0e0ce54f", "comment": "Malware payload (RedLineStealer)", "value": "6e78164215e3f7ea9e3b13889b117b98d6e838e99e022702c827f989a8f81a4b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158933, "uuid": "defd0288-7378-4a97-84d4-311d30cccc5b", "comment": "Malware payload (RedLineStealer)", "value": "1f20af30bfa2f4defdd57dc0d3536edcf4ca5889", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158933, "uuid": "e2f02b3d-407a-4bf8-877d-dbeeb3ea12a7", "comment": "Malware payload (RedLineStealer)", "value": "d53865443249e365a27204f358327f5b63ebef30d9715bdb72dad9239a37c89fd085b7545630b4bc8a16c963d0a34048", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158933, "uuid": "f3f266db-1ee4-47b7-8e17-920332ccb3c0", "value": "T16D152199DAC33EEACA288E31E0863FF06354DC11B9259AB7072509CE7FE7165DD13096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158933, "uuid": "856d1f3a-b599-457f-9df9-fc69c917005c", "value": "3072:C2dStvIm+eAN0nZ5B4Nv1mPEb7FgjiOABnzpRwbySikZ5SLt8gW3FV32PhMa7:CgyUyG6EdhzpRwbyS12mNUx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158933, "uuid": "a51bd927-8496-49b1-8342-7d2ef8e41418", "value": 928588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158933, "uuid": "3f908440-edb0-4fef-b75c-5dbfd1042d58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158933, "uuid": "f288e048-70f2-4c69-969c-a24e2ffb1e1b", "value": "Launcher2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788d607b-cece-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680162169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162169, "uuid": "d333fc46-720b-4381-bb81-7c6811e59f28", "comment": "Malware payload (AgentTesla)", "value": "004fa1dc876651dfd0496d1618aaee85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162169, "uuid": "c15b1cf1-1a3d-4890-9fc5-0b0e1174bc30", "comment": "Malware payload (AgentTesla)", "value": "6e87e1c7ffeeb2ff4badfb5a7eff18a8d55de2ff5efef6ab1ec4820048214318", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162169, "uuid": "d5a4d6b2-3e68-4f8c-98dd-45374209f494", "comment": "Malware payload (AgentTesla)", "value": "8e3eb714851e87d9c11529a2404fe26a5f2c43c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162169, "uuid": "f10d0e23-c16e-45f2-b61e-532cad0804d9", "comment": "Malware payload (AgentTesla)", "value": "df15b5b955e265efaeb04cfc2fe21930bd6f227bd84ebae78a64762cbb328c96d8c4723615dda1b14b30c077bdd09ab4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162169, "uuid": "9f0c1ae4-82d5-4bf7-9d0c-5a105584b8fd", "value": "T1CB657D0477E9864EF26F4674C072043607F2F517F552D7AF9FA1A0A839E1B96AD023A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162169, "uuid": "02f15af4-5a3b-4fb2-8ebd-f6ad7fbd9dbb", "value": "24576:xwiEM3bSghVC7G7bwXCrRLq0PqE2qpbh4lz1WQqp2pA19CA9+:6cb1hV/8X9E2qBh4x1WQAl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162169, "uuid": "a865fe39-86df-4df9-9a69-ce6a732fa47d", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162169, "uuid": "0a5fbb70-090c-4fa2-a35e-6f7e08dc8eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162169, "uuid": "2b53f68a-f412-4c0b-b2bc-d6828448452d", "value": "3M KES\u0130C\u0130 TAKIM M\u00dcH F\u0130YAT \u0130STE\u011e\u0130820272023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9d5c77-cef8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680180032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180032, "uuid": "4823d54f-f43d-40c4-87a8-11a88af0750f", "comment": "Malware payload", "value": "e1ffd7169723718a4509090d0ec56a50", "object_relation": "md5", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180032, "uuid": "df831afe-fc0c-4323-8c6c-9496e4c6228c", "comment": "Malware payload", "value": "6e912515420f0a7f3898995fa252832e9a12fe1bde90deb0ff9ee6612505d206", "object_relation": "sha256", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180032, "uuid": "e8c5f9bb-2a65-472d-ac24-7b9915104a52", "comment": "Malware payload", "value": "ac08b7f74db3cc6be613372f7a079f4607998de8", "object_relation": "sha1", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180032, "uuid": "fcb9ae4e-c795-4bb7-8824-bc4a606b0126", "comment": "Malware payload", "value": "1489677b1f569b71a93e566d683d43fac906e489dddcfa6b7f80a16ea6a9046c8865386cc5c6852861c61aa989e54d0c", "object_relation": "sha3-384", "Tag": [ { "name": "3CX Backdoor", "colour": "#4BC788", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180032, "uuid": "e7104bce-3895-40e8-8d11-95c5794545c6", "value": "T1AF44233586C9E063DC8CFC5ECE94CAFAD78D6C9679124A9003E1262C9F73947448FD2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180032, "uuid": "c59b0947-8c80-4de1-bd56-0cde842a15fe", "value": "6144:4/zekjVpLSgTEkMOqfr6zonPJ/QmuAqPjFQGsV+8C4DLVUV8188e:CC4LEkk+zOVQjAMyGsXBDCV818z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180032, "uuid": "fec57013-2993-418d-8846-e183151278a1", "value": 267423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180032, "uuid": "20fc5eaa-12e3-4250-b898-f721317301fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180032, "uuid": "efb83f31-c58c-4540-9042-4bb54bb0c8f8", "value": "11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf63cc45-cede-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680169187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169187, "uuid": "4d1b05ea-e948-45c4-a4b4-824ef9a5c9f4", "comment": "Malware payload", "value": "4bc5b8d803cbedfc41a1229a47c037ea", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169187, "uuid": "3f47fd1a-fc3b-44a4-ac9d-cd5d437b8115", "comment": "Malware payload", "value": "6f1e4dd5e4f16602176a0c747749324db542c53ad7efbfa63ec9a97a58341048", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169187, "uuid": "50351e33-9576-4456-80cc-3a2fd50f1653", "comment": "Malware payload", "value": "c1ed2327d436f87c6240c94a44f6517711526169", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169187, "uuid": "153917b5-d482-439b-99b6-21b5f4d60029", "comment": "Malware payload", "value": "a2146bae4e6071c9b84fb5f9898bf0902be09468910ef6744d7a322c2de08a2fab6322b3ed837fed5cb4250600442521", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169187, "uuid": "c5b04a50-6a74-4aeb-be46-2040a1b5599e", "value": "T18994E0132108CF4BE206CBF87F63B98D560DBE21B1D635D76A84B74FAA30A27599750C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169187, "uuid": "8da12cc6-fb09-499b-b94a-0d36d1abc284", "value": "12288:q+aFiKXK+WQmmme6v3QLQuEgEc8ulKAvzspbC:iLK+WQmmav30xTEc7TvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169187, "uuid": "537df4ce-4123-44eb-b705-a186dc234287", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169187, "uuid": "cfc21d25-c610-4002-8ad5-99c64c56d890", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169187, "uuid": "e7a306f4-11e9-48d0-95b3-5d3de3ee29db", "value": "Enquiry_sreampa_032023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e65f7bc-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1680196781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196781, "uuid": "929f0656-8c1a-4335-a826-ed1e585f8476", "comment": "Malware payload (SystemBC)", "value": "44c9814d3dba7526300bfee720853ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196781, "uuid": "aa135454-0eb3-4e9b-94ae-c1ec3492b47f", "comment": "Malware payload (SystemBC)", "value": "6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196781, "uuid": "c8b35976-68ad-45de-8b94-90f6ccfe3104", "comment": "Malware payload (SystemBC)", "value": "ec239ce6d39a144a7a78aa623298e756548f1634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196781, "uuid": "643b7297-7d4c-4d65-804a-311d53610fa3", "comment": "Malware payload (SystemBC)", "value": "7ef611e2f525f9944d8241fcd41bd6d0c7b9bb71f827d080029d75b12da2705eca109a3a17384696075267fcf2447993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196781, "uuid": "c47d3807-eb06-43c0-aa85-969191b43be9", "value": "T13DE3D012F490C433C6728A7D0C61D691AF2FB961ABB1D64B3B58076A5FF03D1AA3534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196781, "uuid": "e9382735-1305-477a-b972-a2c28d81ae3a", "value": "ebd9fa475638eafc424b8bc2eb84d2e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196781, "uuid": "bcb860d7-e756-4de9-928f-b234fa996e01", "value": "3072:ETCKOJL9+xhMcgMUzcuNJ6G7V5bnqouw1NckiTdI4O:EO5L9AWzb6mqoT8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196781, "uuid": "52064470-5686-400f-aa2a-27f8c597307b", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196781, "uuid": "056b4adb-cbe6-43ff-9758-87722fec228f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196781, "uuid": "dbec7fb5-a7a9-4930-8162-75bbc922d172", "value": "44c9814d3dba7526300bfee720853ea2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c29b37-cefd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680182480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182480, "uuid": "e35303c9-dce9-4ff4-9101-b39ef3935b48", "comment": "Malware payload", "value": "bce1740ab27701114af3c6c8ace5cc35", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182480, "uuid": "b9385538-e034-4445-b1c1-baddf9c3cca0", "comment": "Malware payload", "value": "70347876dc38d419c6a73e45cdc5a6b0946f2f05c798b9f6a64c47ae30fce64f", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182480, "uuid": "d064add2-84bf-45a8-8442-4f017b68680e", "comment": "Malware payload", "value": "24674bbe51f4e355a2dd0004709e3d55b667d530", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182480, "uuid": "4f6b0564-ff02-4da2-803c-28c19aeaacfa", "comment": "Malware payload", "value": "0faa3147216bd13bccb19158339ece8ff34a093d6d6ff84d52a6ed950c10c4ebe4743a4a1ead1cd1a4c933ca1a5445b6", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182480, "uuid": "42683baf-007e-4098-9ca5-b4c6103bed59", "value": "T104D097288A02C1C3E383B4C32168FC84980E34402CC6EA8C2387CF871CC08E0E50A7B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182480, "uuid": "362d5d55-a8a2-41b1-9628-a2ad79d16215", "value": "6:tr54vVG/4xHe6FJQ9sm53BAKs854f5oeTckc:tuVW4xhFJPI3ylRzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680182480, "uuid": "cb250dbf-6919-4e70-a3c1-9af9bb7f18df", "value": 240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680182480, "uuid": "969d9244-4d28-41bb-8d47-2b4aa3084d97", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182480, "uuid": "86c94b65-b411-48bf-ba83-5ac682f19185", "value": "SHIPMENT-DETAILS.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4175d5d1-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680219200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219200, "uuid": "bd923ab7-92b7-453d-b6ab-22fb3e6e17f6", "comment": "Malware payload", "value": "f301152b766bffb129f8fb73aa15485c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219200, "uuid": "60c8db73-b537-46e8-807c-528dffe7668e", "comment": "Malware payload", "value": "71601ec9b02db66d9c0068b127e3516fec8abde0a13d0be2422f5d6baa58d897", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219200, "uuid": "aac7b495-e072-4e16-900f-286aebf6c6bc", "comment": "Malware payload", "value": "358b972cc9b9fadf48d1c2f1a9b7e0acccf91e79", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219200, "uuid": "0d358091-47b2-4628-b63c-c5b2406258c2", "comment": "Malware payload", "value": "42100c66161d1fa747cbaa8cfb19ebaf35d00afd4847645b1964bcd5bab48cb00777bb475c568b7d97ed7f8b666b0786", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219200, "uuid": "0b1be400-73eb-42e7-b647-60c45623fc2e", "value": "T1EBA3EC12F40AE71FC7A941B5488A937C33B97F0F8648E7E7A109B33978F1A60DA47954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219200, "uuid": "ae637a28-2179-4cad-affb-682b72cfcb46", "value": "768:RgcFMo2zRrfCHuY26gfa3Z5quiV5mI0rAAF852m5bSRfblz3JShT5FcHuurEGES6:RgcFMVz9fcuMtzWNzurIt+NDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219200, "uuid": "ab4abdf3-9965-4a1e-9326-04ccf09ee09b", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219200, "uuid": "203d40b1-dd19-4393-b9d6-4047cef35d05", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219200, "uuid": "07fbab6a-62df-4465-b4aa-ced7f9f15a16", "value": "SecuriteInfo.com.W97M.Invkay.24548.18981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ae475d-ceec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680175264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680175264, "uuid": "6ea0b083-6151-4f14-81a8-9f8ec37a34bb", "comment": "Malware payload", "value": "46c3e19dd65857a6947c28b86df3f0bb", "object_relation": "md5", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680175264, "uuid": "937e2b05-0801-47f0-a728-6448525cb4cc", "comment": "Malware payload", "value": "72349cf4971607c1bc66314069f0c864e8aa4336a663f2afbc2cb7e852465430", "object_relation": "sha256", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680175264, "uuid": "b4b23a4f-5feb-49e4-a6f1-f1e6cf814ec2", "comment": "Malware payload", "value": "0cb17861f3741f10d9af502cc6fbed1a1d12b407", "object_relation": "sha1", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680175264, "uuid": "b89449e7-0f00-423c-a00e-b99a3be77bb5", "comment": "Malware payload", "value": "b4a30b10e1a71e1857224f07b5f1c5ab7160be2ff3e701b388e4b0abeee9dec41ee0ead18bd789b435478c3a48833d60", "object_relation": "sha3-384", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680175264, "uuid": "666a1e94-6906-46c9-be74-83dc5b2d0209", "value": "T1EA956B11B7D88E2BE57E22B6B471105843F3EA956372FB8B2B5CA0792BD37548D01363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680175264, "uuid": "feed3e78-f421-48a7-85b3-8ebe3ec75afb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680175264, "uuid": "663f5b92-a559-4313-b06f-94793992e169", "value": "24576:gE056N9GVAKRZAD9PR9g+3TFqXg3w1uUEO7SwAyKwZ:Pw9AD9PXTvU/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680175264, "uuid": "7f5ffea3-192f-4029-95ed-9f4a75c5e0d3", "value": 1953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680175264, "uuid": "1a76578b-abe7-4796-8419-b1dc6740d60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680175264, "uuid": "934d8300-b9cf-4fec-87f3-da56e585e9c2", "value": "_Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfc360a-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680200912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200912, "uuid": "c754f84b-1585-45cd-b7fc-8c755c23151c", "comment": "Malware payload", "value": "e24e51ec170b2341ef90321640fef797", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200912, "uuid": "2b7e2854-c15e-472a-811d-4db3bace0082", "comment": "Malware payload", "value": "7238f4e5edbe0e5a2242d8780fb58c47e7d32bf2c4f860c88c511c30675d0857", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200912, "uuid": "536fa2d9-b576-4fbc-b220-eb2f26148134", "comment": "Malware payload", "value": "d6066b94968ba76864f930eda55267549eae7f9c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200912, "uuid": "1d8ad0f3-655f-4455-bd4c-a8d36eccae50", "comment": "Malware payload", "value": "a64764892a7c5cdc493d4216ad61340cbdc68e1fa4e8a1b0df524dd15ff7d071049f1680429284991361d8d78f2d724c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200912, "uuid": "961f492c-491b-4573-b250-897fc6970f16", "value": "T1DFE476F0BE01D881F17D5F6AF3ED7908A1343227EADD5A4A00A466591EF7A01F91ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200912, "uuid": "197976a3-5ff3-4bb9-8dbf-c1a9cb7afdc3", "value": "6144:HktnTWI4lCf88RUf4Ta8YWq16RYYy4VSmadyjcPB+F0OvZ9G:KlffX2f4Ta8YWqwRY8we0Oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200912, "uuid": "4611c818-af86-4cef-a925-549a99a893fb", "value": 690526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200912, "uuid": "0ec7c5e7-aee5-43c0-968a-1122a79d998e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200912, "uuid": "6bf7c836-05d9-4411-a527-6ad74014844e", "value": "SecuriteInfo.com.Trojan.GenericKD.61122217.5907.15802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f927bb69-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680158520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158520, "uuid": "8f3bad03-00a9-4c71-a58f-2934b167046d", "comment": "Malware payload", "value": "4cef5472ee0eb02fc8fa9e1491d84645", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158520, "uuid": "1c7e8d00-e20a-45e7-8340-35b53fdc45e2", "comment": "Malware payload", "value": "72fa5399b1e6166250e1eb4817b2990cdd7bc8e107694420de269d96d88fcc7f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158520, "uuid": "7b1f3cbf-9928-473e-a77b-05e1348f68b0", "comment": "Malware payload", "value": "a758a8daaa909a56ff6af879e35afa82bdbc8674", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158520, "uuid": "d809c406-5a00-4fef-b718-cbde032b16c7", "comment": "Malware payload", "value": "17f023d0d63f694a070d5371e16b11ff7df44d0f1e3f125a8d89c8f1c32eea8cd716db78d8d13c4a864bb9b7aadb7e6c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158520, "uuid": "dedc0165-1e8b-447a-a3b7-72dd0ed551cd", "value": "T130617B1457EA0608F3F2AB3A69FE52554E3B3956E932C74E0059414E52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158520, "uuid": "3385c4f7-c525-4e01-b51e-da324f487dc7", "value": "48:8wHasU9Dmel0iglZ+dbslpQfYj1sAT1rTRRSJxodgImcC:8wHmB0+db86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158520, "uuid": "a8a84d5f-0845-4ab8-8bee-dce611e9be21", "value": 3456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158520, "uuid": "9d238f72-ab86-4e1f-bb55-c975fd7e30ef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158520, "uuid": "2eca961a-f99b-45da-9e01-a9f94aa1c62e", "value": "IMG.32546544.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5877e297-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180584, "uuid": "b1e88c59-18f6-42da-8211-be27072e433a", "comment": "Malware payload (AgentTesla)", "value": "4f34b0b75d7b9ebf3fbd77915cba976f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180584, "uuid": "92222dbf-8a44-4353-8897-6e2f94f7f998", "comment": "Malware payload (AgentTesla)", "value": "7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180584, "uuid": "a3297e0d-f4dc-4586-ab52-422b6457722e", "comment": "Malware payload (AgentTesla)", "value": "6b8a77a3a2c4a24c8ad7837fbf4c36e822953345", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180584, "uuid": "ab12b17c-b526-4c3d-81cd-731fe1b0832b", "comment": "Malware payload (AgentTesla)", "value": "07740f1f61f433322d56e4b86fab4805960bfdc763316815a242fd88b11876ba0b82e81fb27ba66a656e06c1fbd14c2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180584, "uuid": "435a94f4-204c-495e-b2dd-5c7348c6b10a", "value": "T125E4E1C132A44593FA7956B196B38DB107723F1C4BA6EBCA6CD634D325F37808118E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180584, "uuid": "6ca70d88-93d5-4547-8438-a810fbbcf7a4", "value": "12288:MQw8m/eoBcBWYwywwpyuTdHEnyzW8M1s9d8fYf9/Ksq/KsI/Ksp:qNBcBWYYwD+KW8HkMtio5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180584, "uuid": "212b7142-426b-4984-be4d-f1fa56ec3a9c", "value": 663448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180584, "uuid": "4b695d11-7dc7-406f-84ac-dd8f8d6babd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180584, "uuid": "9eeebfe3-0aff-480d-b3fa-3bca4d0dfd01", "value": "qFbGYuKhG1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77797dc6-cedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680168610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168610, "uuid": "e850b103-9863-478a-8d36-2f245640acef", "comment": "Malware payload (AgentTesla)", "value": "4aabc22528e6d3a476fdb236537786a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168610, "uuid": "99f06d15-a5cb-4c3a-acf3-846bf1da00d0", "comment": "Malware payload (AgentTesla)", "value": "74066819bcbce9cd3b781a61265a95abd6347eec1967387fad58ba013f677b0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168610, "uuid": "897b11c7-ed63-43b8-bdaa-245a2336113f", "comment": "Malware payload (AgentTesla)", "value": "e4d4250553c8f5ef7cdc8457969da3d0abc8bc7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168610, "uuid": "991c8815-db27-4298-8d10-95ca64003b14", "comment": "Malware payload (AgentTesla)", "value": "e8e258d441e6ef1ca7dd783e2744aabca94b2fe5009a5baa51e330d273c14ade2ac3b8a5b559cf461a550dab383c0894", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168610, "uuid": "ac20f0d5-ad2b-45c9-95b6-25e54a6d0692", "value": "T1E305230E71034533C77D0FF0852162411379EB57AE17CAFE2E66A0EDDAE17E652226A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168610, "uuid": "bf56c692-fca2-40a0-ae15-70812eaeb4bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168610, "uuid": "a01f58a3-098b-477b-93b4-e14a9200319b", "value": "24576:MtHeejE2tfBKNFaoqz7SnfiMTzMixZ1cI1:MtptfcFa/wiIX31c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168610, "uuid": "73bf8672-1c86-4a17-b80d-fd26a72442b4", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168610, "uuid": "3a007490-2bfc-4008-be6b-2d8ab6041898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168610, "uuid": "b0c2ba3e-1309-4d20-9df5-b8a2618dcefe", "value": "106 pezzi Articoli.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1928e6a-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680161379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161379, "uuid": "ea51f4f7-5569-433b-bf6a-7cffe28bec63", "comment": "Malware payload (Rhadamanthys)", "value": "aca9fcf1f29503d74c60b6fbc0a5a7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161379, "uuid": "5ab966f0-b4d7-43ec-957a-64bd76a6a90f", "comment": "Malware payload (Rhadamanthys)", "value": "7525609ab4f283a7e7c1317a373e9f068cb4acf47c9b8c9581bef686a6cac2bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161379, "uuid": "05416d39-94e7-498f-ae07-7b9ad49d4bc1", "comment": "Malware payload (Rhadamanthys)", "value": "28f6c447d1dc3d8d7389a68fd7134711b5ce4265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161379, "uuid": "dc45e380-fda7-4f2a-a3f9-b2c948a797eb", "comment": "Malware payload (Rhadamanthys)", "value": "58da4b9896188c220ff4758c99daaf225481bc986b7ac8b85ce0da226893d6abb3afca860535ba9fbb9b5f991697c01d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161379, "uuid": "79c3147d-9419-40be-a0ed-52a216d01b2c", "value": "T179549E169EFC6CA0F1234A358F2EC3F8261EB8617E55BF5E1659992FC5B03B1D222710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161379, "uuid": "98e847f0-dfd8-4798-8fcb-04509df7bab5", "value": "09829a76b54b4835c677dc6fac4ef621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161379, "uuid": "bb09b9aa-2792-4465-a4df-2f01d9cd6fb5", "value": "6144:yOyV8zmTPoztH8IE/t76ulY/nHAeRsbdWS1/:KV8zmjgtH8Xt76EYvYdWS1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161379, "uuid": "8ab3a9a4-9e13-43d4-9e04-05bb9e881014", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161379, "uuid": "b4cf69fe-02bf-460b-bc6f-f3b3fdd57719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161379, "uuid": "db02516f-38de-4d8c-aa54-93d6e435a390", "value": "aca9fcf1f29503d74c60b6fbc0a5a7ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707e93ae-cf2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680202529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202529, "uuid": "28ac4f5b-6b9a-4116-ad1c-fff42cf74d4a", "comment": "Malware payload (Amadey)", "value": "849376bde5159dad82b0d80a88f99c32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202529, "uuid": "1f6314d4-8229-4d27-a305-50d9a3cdcdff", "comment": "Malware payload (Amadey)", "value": "75531bcd2c92c9ef3d34c1cfd40749827c2d6c4e85a2552e16b6302fb3bdd345", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202529, "uuid": "99a9a5da-d11f-4897-95af-04c20a36f161", "comment": "Malware payload (Amadey)", "value": "8631788c0494ed2161074c4e486ad4ec8aef0ffe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202529, "uuid": "d6258931-1905-408f-94f8-fcaaad5becbc", "comment": "Malware payload (Amadey)", "value": "9c11bd50889798bffe0d2cdee3cbb0ebda4cd146a25e0dbce7e42d6250335a98ed3f7d0f5ac2108555e22e6af77aec83", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202529, "uuid": "8eb5defb-7409-4a3f-ad0c-19afb490e0ad", "value": "T1EA252302ABD91176D5F617B448FB03970B357C125E38837A3746285A4DB22E0E573BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202529, "uuid": "ec39627d-f5ba-4427-a1f1-7cfe60af62ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202529, "uuid": "c6b400ca-7fe2-43bf-83e2-dbe05f32612c", "value": "24576:nybUvbSj+I+tpTnB5rhpfnFPn+r6wlsrJpVG0M7k:yyby+IUJzXUr3arJrNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680202529, "uuid": "0ffeb596-7523-455a-890c-68fabe704422", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680202529, "uuid": "30176d80-ad0d-4ee4-af5f-6b5ef82d89a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202529, "uuid": "c81427b9-4064-4b36-ba81-256603bb475c", "value": "849376bde5159dad82b0d80a88f99c32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39935732-ce94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680137153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137153, "uuid": "64ee6653-69b6-40a2-8be8-fa60581cf0b9", "comment": "Malware payload (Amadey)", "value": "941ebdb94364e7958adc8638cb5dd933", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137153, "uuid": "92f3ba65-a150-4283-997b-61ae9a58a8df", "comment": "Malware payload (Amadey)", "value": "755cb562c506e50661db1966b0c4c6012037ada71e75c8fa2b26e37d2bb578ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137153, "uuid": "1f892340-f06b-4f22-8b51-049fad18863a", "comment": "Malware payload (Amadey)", "value": "378e9367e883360f2a248fc7a0a939d9f58d0206", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137153, "uuid": "64f4127a-f086-4bcd-bf68-796f2fb10ea9", "comment": "Malware payload (Amadey)", "value": "3c973d8973b520a5ff49af98d2091dc23b7e171f66678327ebb707fbac396145155f112043a06184f47de57abed0ef7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137153, "uuid": "0ba29ea9-384f-4c59-9cf3-5a8d27e9dd86", "value": "T12644C02277E1C8B3D91A417A4801D7B49B7AB8314B55BACB27445BBE4E303E2FE35346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137153, "uuid": "fd44be7e-9055-485c-8636-bccf4e815a63", "value": "6d0731e3d08b444b0205bbdbcc6792ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137153, "uuid": "19856acf-2591-4e0b-ae49-0e01224bf576", "value": "3072:NMRgGpTHg8XiSUyWLvCBFYX9CMTQtqXNywNgDoyxn2Gzmx4cYBe:2gGFTiSUJLvOYsMTQEdy4gEmn2GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137153, "uuid": "0352e0c8-f135-4f66-973f-3fd9029b6572", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137153, "uuid": "d184ace0-fb43-49f9-b4f0-e8c1af1af770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137153, "uuid": "9ea5b208-fd3c-4232-a82d-5993b42c78dc", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61b45ec-cebe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680155454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155454, "uuid": "9d87ac66-b3fa-457d-b21a-6d5f0bde99ac", "comment": "Malware payload", "value": "b9ca90d6392a86fdbfee77db7cdc6988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155454, "uuid": "fd779bb5-28a4-491f-bc9d-4e352dd51ce4", "comment": "Malware payload", "value": "758b0934b7adddb794951d15a6ddcace1fa523e814aa40b55e2d071cf2df81f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155454, "uuid": "647cca44-2440-4cd8-a430-8075dac99dbe", "comment": "Malware payload", "value": "acf291e1602be120402759392482d781f900f6ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155454, "uuid": "637eb47f-bd5e-49e6-8b82-f090416cce5a", "comment": "Malware payload", "value": "b9d0082d946ee8dc174dd569e1a3d520624bd7a952964306777b287ebdc599da8a75bd4c98da01e37f9aa56f2504d28d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155454, "uuid": "caa4351b-a371-4a83-9e9e-3bf0ed6eac46", "value": "T1C332B35BBA608B3ACD4697704EE78270A633F5F49B235317324DB6322F093964F0A756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155454, "uuid": "bcd32fc8-96d3-4229-9c1a-2f850ac0905a", "value": "96:G04UTnPnrTGWF3NCA9WX7OIG2E/8A/Kbzme/U/Av949Q1TAX8/r//1+bC/CdK7Ap:G04UzPr1F3NuLvEDqrUXsDgZlqJlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680155454, "uuid": "bd08ffe2-a361-4d3a-9213-944646bbbca5", "value": 11496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680155454, "uuid": "6dac417d-2d05-494d-96f7-535b381a15b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155454, "uuid": "c9af0085-62b3-4e5e-af30-519e02880fb4", "value": "758b0934b7adddb794951d15a6ddcace1fa523e814aa40b55e2d071cf2df81f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6626b9f6-ceeb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680174594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174594, "uuid": "26bd0b4c-43cb-42d5-805a-5e8ddbecc8c7", "comment": "Malware payload (AgentTesla)", "value": "247a371775a0a6d7c49fac9eff1258ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174594, "uuid": "134b8c12-802a-40b4-91da-24b02ed32dc4", "comment": "Malware payload (AgentTesla)", "value": "758f44953380a1b5ff4353a6428ff696fb177b1f2e9248dd90f39c00ce24f7cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174594, "uuid": "43d0f44c-30f6-4143-b429-1ae112b2beb5", "comment": "Malware payload (AgentTesla)", "value": "e5f1cf8dac43355c886eb66af29566ea286f289d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174594, "uuid": "ee914933-e773-47f9-9db6-110a2f18818e", "comment": "Malware payload (AgentTesla)", "value": "2036b46185d97e75e65995f33b2acdbc1651f13c063954070afef99ac32790aee6e7c150a42d9c6e91a69a3adbae12c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174594, "uuid": "6234d039-0d10-451d-ac22-063231c73908", "value": "T108C42326CEC0AB73133EDA5F974F86999E87F113CB5D8C93F7A19E28690408667704D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174594, "uuid": "b81a9813-aa7b-4850-a956-5a936dc828eb", "value": "12288:mUxIRjrfSNSwrN4z6uJJVX7IHpUGABsn9SLzZak1x48KzoU:mxR/kiJJVX7IJMBsGaoxYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680174594, "uuid": "fe1f5221-87d2-4aff-b914-efba40b2934b", "value": 560717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680174594, "uuid": "1cb3eefe-f351-4b1c-8d96-4a3a511ef752", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174594, "uuid": "607ecdc5-3746-4a06-921f-f81f3a5291df", "value": "DHL_AWB_NO_#AWB 4507558646.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176750ec-ceb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680149122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680149122, "uuid": "b99a05d0-c435-494a-806f-e8aed2775218", "comment": "Malware payload (njrat)", "value": "c3d633a94d55c9e2f3b2724786d1ce8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680149122, "uuid": "2a7f914f-6491-46b7-a181-c6aa66800881", "comment": "Malware payload (njrat)", "value": "75fc511739e66615a753d03d5dee62b1c618c78e29c88d761511c271a4ac8b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680149122, "uuid": "f941fd01-867a-4734-8c19-9dc5e5cf4072", "comment": "Malware payload (njrat)", "value": "2ffaa89a262bbff4c3f53971a1340a4ccfabf122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680149122, "uuid": "830d96b0-433c-4917-932c-21b9c87b990a", "comment": "Malware payload (njrat)", "value": "bc6ccefda6f603d196752c786dd0bea99d145a05224058be5f0c98fcbc6291511517b8d43ce44f048140a673366565a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680149122, "uuid": "80295f6e-15d3-4930-ab3c-978278538dcb", "value": "T116449D6CBD8B9E32C2A541FF815167256764ADF3C57BD3237B905AA22E177E0CE021C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680149122, "uuid": "d1ad886d-7435-4329-b5b5-1a606b79b33b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680149122, "uuid": "1a8b26d1-ebdb-4121-9039-7c20849bc67d", "value": "6144:tSzQNiMZgMGLPaEpoDYWHErebot7SFImoReuN:tYQBVEpoDt2ebZFWEuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680149122, "uuid": "0df0ec6b-1421-4a3b-97cf-cd33d2dc1c44", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680149122, "uuid": "65dcab11-79ec-4159-a7f5-a0c1929c9d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680149122, "uuid": "9c98bb49-56b7-4f99-b299-e0a276e78618", "value": "c3d633a94d55c9e2f3b2724786d1ce8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f337c9-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680161687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161687, "uuid": "55b79ba1-68aa-4dd3-8074-6752a1da31f6", "comment": "Malware payload (Loki)", "value": "339a80192eb65dd95541a88b690e54d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161687, "uuid": "b27ba655-a9c3-4380-9e74-61633807683b", "comment": "Malware payload (Loki)", "value": "763fc70c680ac478f31474306d6bb7a0f34893f98d691e0a49b6948a800cf7d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161687, "uuid": "6c0e23d3-a18c-4aec-9a8b-aa141eaf6d08", "comment": "Malware payload (Loki)", "value": "4c142cdfc4be057085c0a1ab70918a5c3e827c58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161687, "uuid": "a7419e41-6dc6-4154-bedf-08dbc671187e", "comment": "Malware payload (Loki)", "value": "2f8750b0a23e744c5cb5fa49b4b22f2f92716b9bb900761ba9fd8d19eebdea7057806fc765455e02bd2380b5c8537508", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161687, "uuid": "e7f14232-c4f1-40de-8244-3ef27d7d4e45", "value": "T12DD4F11032DE8116C7A6877A81E4D2B0777DCCC9EA69C7A31FDAFC87B2CA3465521187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161687, "uuid": "bd8ee98d-e09c-4aec-a8f3-89183f289a26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161687, "uuid": "9dc64b09-9e4c-4d21-ae3e-059953689dd5", "value": "12288:SeJ/sIx4gh38thW3MsYiGw0AQkFwGrZ3ER4Y3ylimOMt+m1:NUhW3oxwFFN3g3uimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161687, "uuid": "d87c3b88-b5c4-4824-a5ee-ac0159809b02", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161687, "uuid": "83f7a2b3-ee1b-49ea-b799-fa84e1c02a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161687, "uuid": "063d7008-d56a-4e02-9930-4546f8aa5cc7", "value": "339a80192eb65dd95541a88b690e54d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f931188d-cf4a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680215643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215643, "uuid": "23053578-d3ab-4291-94d0-ce3329740ad8", "comment": "Malware payload", "value": "f9af535fdde6ed26dee09e463e9a8504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215643, "uuid": "c5cbc5c2-9d8c-40d9-bf55-60286aebad74", "comment": "Malware payload", "value": "76f3e3d7037d2ac53855b0f75d7fa62b8f61f0811c4bf070a5ee146fb10889c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215643, "uuid": "0480304c-98c2-4402-9834-61ba7d296e4b", "comment": "Malware payload", "value": "b45d891d0051300965e3de0f5496a6fd752b287e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680215643, "uuid": "62a370dd-6e23-42d1-827e-08cc47fcf6e1", "comment": "Malware payload", "value": "3c6f269a46a5d3628914e0a1f2fe7bde62c1ffac4e17ce7dee965a51c87a89b74e45643dcfd99ecf4b7e7f1ebe23db43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680215643, "uuid": "25fc98bd-e752-4403-bca6-c9350e1e1141", "value": "T139173397175004A1D8BA143E4582D9324276FD526B20EBAD03D87D2F7CB7AF1AC37BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680215643, "uuid": "4efc9800-e679-4784-9d70-a92a94fbd6b7", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680215643, "uuid": "7c311145-0f84-43be-85a9-d2a0093e3514", "value": "393216:e+xAlnc1IquqAQIdSgsitlA1rQQNaXSDDNW7jl7lZy2Ij0d:Ylc1FuqAaitlA6QNaikJnZ4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680215643, "uuid": "6eb19656-992c-4d8e-8f16-55a0f505d82e", "value": 20139739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680215643, "uuid": "5167b470-8d0e-4b8b-8210-9a88ca445d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680215643, "uuid": "60002578-3c9c-4058-8408-a8c55026f663", "value": "BiteSploit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047df9f2-cf24-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680198911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198911, "uuid": "7970e5c9-5294-454b-9959-a0f99b624625", "comment": "Malware payload", "value": "f2376fd96d3835fe463beba561079f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198911, "uuid": "721d78a0-b75e-4d95-803f-3a6a33494038", "comment": "Malware payload", "value": "7787da8c1ea7520800ec2112099e01a73b0c2b872d03055057999c534c82c736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198911, "uuid": "77297bd7-d1d2-44a2-8667-dca62725c2e8", "comment": "Malware payload", "value": "5697e0a3bf14446df90f5be9df0af03a7f1c01ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198911, "uuid": "f490d0c7-062b-4504-89d2-b53cdb2b2f9c", "comment": "Malware payload", "value": "0cfc00e7bec442f43777ee7192eec004afaca8db31c8a925b6af24af4975396dabd6f2323a58ae997094ef47f44f267b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198911, "uuid": "8e4fb1d9-c9bb-4f98-a944-8445a5f9d88d", "value": "T1BEE533BDAA574622C85407B0CAED0B156B3BE5B304E6D9573ACC2DEF9E22374114326F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198911, "uuid": "f5a45925-a1ec-4b4b-afe4-0b534b440693", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198911, "uuid": "e7b7a804-fa38-456b-8fb1-8231ee6a5c9c", "value": "98304:EYgiM86DCUMzGEYBQ+soOp/G9sdHACvQFzmCvi:QxDLMK3S+soI/pdHuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198911, "uuid": "16644047-67d3-4cef-90f8-a717405c18e5", "value": 3250688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198911, "uuid": "ab2b9f86-e730-47de-ae2e-81243c81579c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198911, "uuid": "903a1969-e77e-424a-9ae8-1666f1570b3d", "value": "f2376fd96d3835fe463beba561079f70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e3e1ea-cedb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680167587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167587, "uuid": "981cf50f-bb91-4453-b272-42975e233aa9", "comment": "Malware payload (AgentTesla)", "value": "319307604d727fd2caeac236cb968b27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167587, "uuid": "d3c0ca51-93e3-4907-acf7-687344e4d929", "comment": "Malware payload (AgentTesla)", "value": "78d2c30f07aacb40da92c21af1dc660a690074ee35da707c81d06d146c631a28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167587, "uuid": "08789b97-3731-4887-99b0-c1896e54032a", "comment": "Malware payload (AgentTesla)", "value": "c0723f45066f65812092eb768f994bbea5683085", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167587, "uuid": "b67c3e1a-49c6-4124-9c58-fda22e03a416", "comment": "Malware payload (AgentTesla)", "value": "b09586d0396d85920c2aacdeb5df08769949aedc1fca967d817043487650ee6225ada27a69ea2088e3612f94304662d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167587, "uuid": "5f683ee3-5d26-49b5-864b-a2c547c61c95", "value": "T11685F1733B509F94DEBD0BB15392D060A3A6AC6AE911D30C5FC411DE2EE5BC11E25B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167587, "uuid": "d6a4b4b3-4c97-4b93-a279-7b5c8fa42ddf", "value": "24576:CFJvj8ZE/OK1yhYcp/2111VD+7AB7L+KgyrrrrPrF0BMnlE6AE6nnjqKoep:C/qE/OEGh4ykODyFBnK6ejqKoep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167587, "uuid": "573be5f8-6f1b-43b7-a90a-386677958947", "value": 1766912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167587, "uuid": "0463e567-cba7-49a6-a716-3ce349a49a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167587, "uuid": "22aeea01-b32d-4a47-acc1-824c2a5c49d9", "value": "QUOTATION#231984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d2e214-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680160949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160949, "uuid": "1b1d6ef6-8bdf-46cd-a3b9-3eabeb54ee65", "comment": "Malware payload", "value": "3a9f2d0dbd485d899c1767ce9687fa24", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160949, "uuid": "b3cc3c25-c5cb-40c7-89b5-5415f83cc112", "comment": "Malware payload", "value": "78f31d22897cf415ac8d36346739b48cb685aeda302deff263ecb0b03453e642", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160949, "uuid": "b17332af-b461-4568-bf00-b8aa3d2cc479", "comment": "Malware payload", "value": "e127b2e0c296097ef6943bbcfc07e8d25cbe335e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160949, "uuid": "50e84547-08ef-4fda-8a8d-6cfd38be6261", "comment": "Malware payload", "value": "9b9ac22108bc3d51e4252d621106e163de24a0fc4ba967682a3c72fcdf8ef3f7ffffad9ac99df0392c6d1dbdf0a76b3e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160949, "uuid": "6632c988-2411-4a17-9de8-f26e13b29b79", "value": "T11D2523B2A542B8C0C87B07730EB9B1117E27E7BC7E13818DD99009D7BB91E5B1B506A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160949, "uuid": "9c658667-2804-49b1-b1f0-80fba86040aa", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160949, "uuid": "0082b5e9-5ae0-49a7-979f-881d4b8a3d89", "value": "24576:5QnREwy+O1y57XgBPovuSECIa7hLH71rrDmUNuwTzb1e:5QnR5y+dLGPiuSn97J7ZHmd8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160949, "uuid": "aa59fab0-2575-45c3-b41d-d70ebe46be9a", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160949, "uuid": "4f90b3e1-c8ab-478c-97b8-af16e5b7aa83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160949, "uuid": "fbf0d737-6417-4ca2-adc2-0fdf7d90e392", "value": "stage4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d3ef2-cf05-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680185818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185818, "uuid": "5b51b6cd-204f-468e-9441-39d6ac5fdcb7", "comment": "Malware payload (Mirai)", "value": "ee6b5d1158f014164fcf8ef8129d815e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185818, "uuid": "b221aac8-389c-40e7-a2a0-07c644669b9b", "comment": "Malware payload (Mirai)", "value": "790faa4fca778e11839a75c76b0537b9124ba01397127bf8419319c16cc4312f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185818, "uuid": "22b8b719-1171-43b4-8ab3-58d39f8c6fb6", "comment": "Malware payload (Mirai)", "value": "bd0de7554d10c36ae20f009461ec3e9f64c44d91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185818, "uuid": "86efc44a-23a5-4d49-ac83-e3d9a28ac52e", "comment": "Malware payload (Mirai)", "value": "143f3040faa8f60320c50f5dd3b4db8369bac71086903415ba3d2f7f2f0e13ca3cfc8222e1f3b205a4c12132796b2c25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185818, "uuid": "ae968d0e-391a-4b2d-b0f2-908d455193a2", "value": "T18A63A80E2E258FBDFBAC823447B78E219749379526E1C584E15CEA015FB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185818, "uuid": "f26e4746-bc37-4951-8aab-764d136436cb", "value": "1536:NsW3j2TlFXTc2qkUOsZnpGZv/6OC3GP6czZuwkkJSEjVt2N:t3jilFXf8GV/xJIrkc4VtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185818, "uuid": "7d877c8d-558a-4ceb-a650-a76ef553ff8a", "value": 71772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185818, "uuid": "29325aa4-da44-4e08-b852-9d0399708c63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185818, "uuid": "979782e1-ee87-4fcb-8c06-d5ed8134f1a1", "value": "ee6b5d1158f014164fcf8ef8129d815e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fb788a-cefc-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680182132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182132, "uuid": "cc81cd14-0795-42dc-8048-7f4cc9efb9d0", "comment": "Malware payload (DCRat)", "value": "1d76dd954e3becd340ccf4d4a094a30e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182132, "uuid": "2709e6ee-5fd6-427a-99b8-6121ab4fbbcb", "comment": "Malware payload (DCRat)", "value": "796d694b4c131219a2181dcf86d600b8b345c0ca37b46d7d637b884eda751149", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182132, "uuid": "d93e4baa-3767-4284-b842-69cfa971ab72", "comment": "Malware payload (DCRat)", "value": "0def09cf3b8ea3377d22446643bfa32ea9fb04f6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182132, "uuid": "528774ce-1d82-4133-aafc-d70674233c24", "comment": "Malware payload (DCRat)", "value": "6fd732685ffb2fd339d58c5293443e8b9638f545fb9d230d14c6900f626a513aeb0950e5650081171c1e7052e67b7618", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182132, "uuid": "cf085a30-e016-47f6-87a6-46d0d0f0ffae", "value": "T1E8B57DB21293FEC4D76F2E48C0443A40DC206877677CD258FDCA299B92E56A4DF5DAB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182132, "uuid": "a3bc6727-6c55-4658-99c4-5aae591e709c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182132, "uuid": "9f934635-4709-41f6-a235-9d8b0c11e740", "value": "24576:35pnhtPnng7FlDvWDB7371MCFt7w9Ot09OX7l348A5NyhziD8YvsBKtASBD56ClY:JLSh0jXbH2nDTrJqh0UAfOnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680182132, "uuid": "49b9a236-4d57-47fa-abe5-eff7eae14f73", "value": 2297856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680182132, "uuid": "9da9b081-49a1-491c-b542-0deef6540da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182132, "uuid": "55371f53-546b-4134-a7ed-0a6dbf2b7b5d", "value": "1d76dd954e3becd340ccf4d4a094a30e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30d7618-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680170965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170965, "uuid": "bb4bab73-18df-48ba-84cf-0b8a69ab7221", "comment": "Malware payload", "value": "74bc2d0b6680faa1a5a76b27e5479cbc", "object_relation": "md5", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170965, "uuid": "dca0c2e6-4706-4cf1-b0c6-b8ee7fe56852", "comment": "Malware payload", "value": "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896", "object_relation": "sha256", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170965, "uuid": "325d1218-66af-4e54-8ad7-6be7e2396e81", "comment": "Malware payload", "value": "bf939c9c261d27ee7bb92325cc588624fca75429", "object_relation": "sha1", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170965, "uuid": "f5b44bda-008f-4be0-9fbf-720a6b1ee4d8", "comment": "Malware payload", "value": "35c523ed777990fc4382eeac659885916d2137e8b28041275c085c0d6cb69efe4ad771b4ec2dab434b5aee1bdb11c0ca", "object_relation": "sha3-384", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LABYRINTH CHOLLIMA", "colour": "#933F3C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170965, "uuid": "d21b3f8e-f574-41d7-8b9b-291964b039d9", "value": "T15AD5AE07E6D50099D019C534879F9233FA31384A8B24A6EF1B919A243F7BFD46E7E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170965, "uuid": "c53310f6-d1d3-4c86-b108-c5be61cc0664", "value": "33955ad6c8fb7e74dee473c690ca4dbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170965, "uuid": "f74f6b34-aa9c-4c1f-a9b0-a6d95baf1c91", "value": "49152:rLqBG2uIgj3kAFN2bInEkQ2L2A67dxhlsZDKUCIefkeJYbQWzKpDdN3lzl3hmmGP:rt31ekQhZ/JYbxKB838G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170965, "uuid": "1ac8259a-7163-4388-a918-d117aa40537d", "value": 2814976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170965, "uuid": "a41d23cb-9b1c-4dba-8077-76844db7d638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170965, "uuid": "9fca8a26-ee32-4644-b738-fe64167f7f2d", "value": "_ffmpeg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915aec91-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (NosuStealer)", "timestamp": 1680161352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161352, "uuid": "6398f66d-a6a0-4be4-b88c-5602b94e98a1", "comment": "Malware payload (NosuStealer)", "value": "5063720ae56bc347acc896173016cdc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161352, "uuid": "a4a7716d-ab86-4ed2-8bb1-7d7f5e7f5c7a", "comment": "Malware payload (NosuStealer)", "value": "7a70ab7f2f11a71d0976ebb46311da4409fb1ec16e9d0c544d89a7a383f3035e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161352, "uuid": "2dfcac6b-4092-4e67-a763-f552610d1052", "comment": "Malware payload (NosuStealer)", "value": "d383766d222b27b438fec42026c4d8be0d5c700a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161352, "uuid": "57751a43-ee69-435d-980a-81043574c343", "comment": "Malware payload (NosuStealer)", "value": "60e37ec1aa897c84daee020367f40bb69516948410bf53a846f542ccbe7b29f2c4ea2b025e056875b81fa04a94ab81dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161352, "uuid": "d724dd3b-70a5-4e88-828c-7c40d91b83d1", "value": "T1A9F49F22F2E18437F1322A789D1B927CDD267E106935E8467FE59E8C5F38681372B193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161352, "uuid": "bed3fdfe-3c4e-4386-a224-bdbae20ddc49", "value": "97097c6816d59e0e343951d5da613aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161352, "uuid": "d4ac7f69-70ac-47a5-959b-7358537d8ba3", "value": "12288:zPDiJJG05qrVujzjkv45nG2JoGhkgGt4z94qCb4jyKrxo6EbpYx0:rmb3GVsfkv4I2Wi0t4I4jPG6Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161352, "uuid": "6aaf713a-f556-4ba2-86b5-d2ef297636e0", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161352, "uuid": "0a7c8c49-a539-4592-8d66-aeb6812e2d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161352, "uuid": "9fd906cb-c7bd-49d7-aac3-b1bca7e16289", "value": "5063720ae56bc347acc896173016cdc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d4255d-cecf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680162625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162625, "uuid": "80b6c01f-e71a-438d-97f1-0d68418268ce", "comment": "Malware payload (RedLineStealer)", "value": "8bda6a55fa10de2c5dbfd9605b179f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162625, "uuid": "5c217097-7125-4cbe-9b55-45118630e88f", "comment": "Malware payload (RedLineStealer)", "value": "7af8d8152a2494cea6783871d3988679d33806f8cce576f1288d5c16cac8a966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162625, "uuid": "be1d4b69-0624-4dda-a84b-d87a4688efc3", "comment": "Malware payload (RedLineStealer)", "value": "5e37892e6729a53eab618f88072310bda0017f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162625, "uuid": "0dfc1775-890a-4e09-b2bf-dfd64ee1399d", "comment": "Malware payload (RedLineStealer)", "value": "94c85a45d290150368f78ac78b3406466f5b0b525f05c0c88c3f2e0986afaf12dd5be4680c139c40f0ff2fb731d56fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162625, "uuid": "efa8e62e-cf80-4b2b-90a8-8f6b444659ba", "value": "T1B8252363EFDA6432D872673038FA06930D35BC729935C32F2746A89A1C73594E279B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162625, "uuid": "d2333740-7515-4069-b023-028cf0cf5b2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162625, "uuid": "4a042940-3e79-43be-867e-b51a871dd4aa", "value": "24576:FyHVuQa985OcdehgMPnRrncihmfaTelMbRvmvhVK+H:gHoQadrPnx+pStoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162625, "uuid": "57665a80-a409-42ac-b013-1b7470db0a6c", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162625, "uuid": "72debe92-606c-4c47-a994-702decb9ced2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162625, "uuid": "4bd7e70d-6a51-4c55-af82-c2f25c748869", "value": "8bda6a55fa10de2c5dbfd9605b179f07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd13770e-cece-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680162311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162311, "uuid": "abc65e2d-06b4-4085-a009-ee72524b9bf0", "comment": "Malware payload (Loki)", "value": "29e1f1d82f7cf1c2f4f3e8e6eb40ea9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162311, "uuid": "98c7960c-4ae8-45c7-9cad-2d2e49c59e9c", "comment": "Malware payload (Loki)", "value": "7b36ba68604194c04691a704eecef41ed011a7c3f36054948a2b3a6d34276e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162311, "uuid": "31a7349f-7995-4917-b38e-a4b3ff8ef080", "comment": "Malware payload (Loki)", "value": "18ec7c08df90813779969c8c864edb39493b4ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162311, "uuid": "f7c81781-0889-4176-88b5-d2f6abf60af6", "comment": "Malware payload (Loki)", "value": "96bae8de9c4f44f36bb8277a00f2dd3c6bb85c6ce6516278aa2d21b4a33c41cdc15415ccbac7bf2133607eb06abf2563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162311, "uuid": "a4571624-9b5f-477b-aeaf-eded218d87a7", "value": "T17CD4F19036DDC11AC665437D81F5C2B123B9DCC4EA69CBA31FCEBC8BB2CA3469521197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162311, "uuid": "0ad41cde-8e81-46d0-9347-a0f6c720d9ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162311, "uuid": "19a233b9-6bf0-4316-9a85-17083cb27580", "value": "12288:YeJ/sIy3rlhsimOMt+RdA2U4u41Hj0WXHCTA2FAYNt01Jp29jZ:Eh+imXuAw1X3OA2aDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162311, "uuid": "939fbf95-ac71-48ed-a3a8-c027e68c3c86", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162311, "uuid": "bc6a3379-09fe-440a-aa94-6ad7c1cdd301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162311, "uuid": "f86b23f1-d93e-405a-b22a-b0af9c9801c3", "value": "SOA..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3492b477-ced2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680163773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163773, "uuid": "ad5fe160-7cc1-45d6-9d1a-873d6ed96824", "comment": "Malware payload (Formbook)", "value": "348e51874930db41b232a0bab0a4c040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163773, "uuid": "cc99a47c-aecb-4f59-9337-8eaf27a6ba4d", "comment": "Malware payload (Formbook)", "value": "7b8a4cea9f76cf8dec6243f6103244578618081c05cb9927a9b7f619c32d956c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163773, "uuid": "8e68b671-1cf1-405c-a785-5d046dd963b4", "comment": "Malware payload (Formbook)", "value": "acac6fe84007d3d4fe18b38ed48e2892969aade0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163773, "uuid": "ced80487-cfe0-4d39-bc34-7ea9cf4ba4e2", "comment": "Malware payload (Formbook)", "value": "0be1879b84b81c395e0c94a39e53fba5c432fa8845a6924a7bc54fc12363d68c929636db80d65d1b9b1e358ff606df0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163773, "uuid": "e3c621e1-b2bc-4366-bc14-3ba8e456b504", "value": "T16F5412A5FEE0D477D876C3310D3F863AEBF2992295B6911313612619F867242ED0F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163773, "uuid": "09575264-f855-4ee4-aca9-0ee9a4518dc9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163773, "uuid": "06729b2d-1b04-46e3-8e02-0f759b9f198d", "value": "6144:lYa6+jWEbungXc5BK5jruw+hOmdRe5BHMdtl5nC1Azy:lYUrCnQtTOOmdIOdDty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163773, "uuid": "333be2e5-e40f-4651-869a-f3fc8c99d842", "value": 300661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163773, "uuid": "bc361aec-8c07-46cd-aff9-104b97adc74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163773, "uuid": "c3edfc79-aaaa-41ee-bc52-d7d4fc8fd119", "value": "TTCopy-240323-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d56fc9-cee1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680170347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170347, "uuid": "0cf95275-9858-4e46-83f8-f600ff73d6a0", "comment": "Malware payload (AgentTesla)", "value": "b7fe0283cdd93788a35df6f5b541dee5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170347, "uuid": "cd42b2ff-e54e-4fba-ac5e-c31f98d29b0b", "comment": "Malware payload (AgentTesla)", "value": "7bb024a9f018978f826a9e3f9367f834427df51b1cda41ed11fd61701ec5d4dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170347, "uuid": "b95089d0-a0e3-4ffa-9309-e59f822bd25e", "comment": "Malware payload (AgentTesla)", "value": "20e62c66cb2c19de2d5dd69a666e7220d123b038", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170347, "uuid": "39de36a9-98f4-48a8-9926-578490ca4734", "comment": "Malware payload (AgentTesla)", "value": "e03b2b3f30a4a6a33968fbf73d35b24007ed35ae0ca414a3ac0424d2e120d4cac90cf24526a45ea14f172a557c3a55c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170347, "uuid": "23b6f38a-ab72-4218-9f4f-4c6d1c554001", "value": "T14F05015A32AADD03C28D65B1C1D311180371AE435773D75B7FCA029A1E067EA9E4ABCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170347, "uuid": "bfdb84d8-8946-4410-a789-420729fa3b7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170347, "uuid": "f15e56ad-e1b3-457b-adbe-c01e76e3b511", "value": "12288:Wxc3xALb1QWBV+wsySEPqdyrlHgtFqZOsgdMbG4KojBgDQUPwNu5epYUUj:W4eV+wsBChHIzWbFjV/Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170347, "uuid": "7f4ecb45-302e-4a51-809a-829f334376e5", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170347, "uuid": "e9a9eccc-4849-4006-9e05-a804e724f4e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170347, "uuid": "7e1fa39e-ced6-49f3-a58b-3f257aec69ee", "value": "b7fe0283cdd93788a35df6f5b541dee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea71e8e0-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680185124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185124, "uuid": "b26aca0e-7533-4955-a52a-a588236f407d", "comment": "Malware payload (AgentTesla)", "value": "a85b55466d5c83a3c9b988e1b098584c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185124, "uuid": "13774e17-6ff4-43cb-96d4-8fcd03380ed8", "comment": "Malware payload (AgentTesla)", "value": "7c69c8b13870df342b88a74c4593de7cdafd313516a613e6d2c358654989b197", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185124, "uuid": "60d97ca1-cbb1-4856-9eb9-ea73efda6669", "comment": "Malware payload (AgentTesla)", "value": "df09609a0f86dc2e2970ca8f3df936649aea1a1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185124, "uuid": "e783d6cc-20dd-40af-9894-f3aad0a0631b", "comment": "Malware payload (AgentTesla)", "value": "f8e0bd156e6f2f193386fef2dd7afd5f36c27748a1dfad31f66a8344fc1a4dd5d98c7b9e8c25ac7179e997278de06efc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185124, "uuid": "f0e367fb-a2eb-4d14-8f48-1f071953e5a8", "value": "T15FE4010836D98609C16A937A81E1D6F0A3B5DDD4D663D3234FCAFCD3B39F39A552018A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185124, "uuid": "79de2855-395f-4771-b00a-1bbbd11f3b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185124, "uuid": "c80add1b-f920-4699-86ff-fcca5c5be38c", "value": "12288:c7imOMt+1ZayM10SR9kO9evMVDg9y4mEzKrLg08kNRzg:c7imXqZayM10SBCMxg9y4mIILg08k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185124, "uuid": "8267e8c9-690a-4d24-a2e7-6ee603708c06", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185124, "uuid": "716b5b82-3622-41a0-ba30-939c70a31e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185124, "uuid": "64571c07-005f-4016-885f-a100b824054c", "value": "7c69c8b13870df342b88a74c4593de7cdafd313516a613e6d2c358654989b197.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893352f8-ce92-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1680136428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136428, "uuid": "7ed64da9-ec59-4aa3-a9ce-f1b8000979a1", "comment": "Malware payload (CobaltStrike)", "value": "d223ac403e9ac14ae07b6edfeb018deb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136428, "uuid": "61a7963b-50d1-4295-8eab-103b3a410ddf", "comment": "Malware payload (CobaltStrike)", "value": "7cf3379bd4c558c88f9a6e7b5aa6cda3aa9ba4289148e8ca6b0b55f378cd612e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136428, "uuid": "9dbfbc1d-be6e-4f2d-978f-a935d20d5d07", "comment": "Malware payload (CobaltStrike)", "value": "9be80a8babb8d08d07a68d5b1d0018992fe402fe", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136428, "uuid": "5bfacff7-be33-4e50-963d-0e5dfe6d9c20", "comment": "Malware payload (CobaltStrike)", "value": "6868a5ddf16e17efcd8e4b321cb159546c628d09a4837b455a35b9d0b89f582811c51c69589c563bb1e9bea3eaf1b5c7", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136428, "uuid": "d7599632-9643-487d-b85f-a5223b6f570a", "value": "T164C20C1388BD01A0F6167DA1027A6D83CDC5AFFF2C2E48B165B6E41CD199C8D6BE563C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136428, "uuid": "a22b0df8-77e9-4962-a1dc-b5b44371294a", "value": "384:/IAUl9V5xJCdNz6etOzzodsGeE3WdbSU0jRArxJDZF6boFUUC7+v6fCUqqgCENqn:gAUjKz6r5GeW+bOoCvK/imC6YEaxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136428, "uuid": "f9ef018f-d57e-4a23-a978-22f99b32dbac", "value": 26715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136428, "uuid": "2ed80b87-e980-4bfa-b8fc-fc7630d07fde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136428, "uuid": "2d162650-15ff-4a5a-8715-65515efa40b1", "value": "ANQUAN.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aadf93-cf05-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680185836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185836, "uuid": "59fe507b-c9e2-4fc4-a8e5-e01aa6fe8dd6", "comment": "Malware payload (AsyncRAT)", "value": "6d947dc383b8ba3288bcc62596542a49", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185836, "uuid": "87a26511-6a93-4f93-88b4-a502c027924a", "comment": "Malware payload (AsyncRAT)", "value": "7db33185f1eb10c9ad3a85f38c436d65975b2ab20887683898a27fa5fb7864fa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185836, "uuid": "46896ef6-228b-439d-a0d0-ad2ffeef52cc", "comment": "Malware payload (AsyncRAT)", "value": "343726364297f2ca5d4ee6ef27a81b15e21fd4b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185836, "uuid": "c98b8c0f-0884-47e9-aec6-b16adb554556", "comment": "Malware payload (AsyncRAT)", "value": "2b391525f8c7bfbe1f266dfda9832cb8d00221bd3f5cef0d3a0513d4baf86bbd2455f952db936a70c2d4b1c16b46a909", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185836, "uuid": "b46cf2c7-dc2a-423e-9e3e-cfb3969c5496", "value": "T19C348D143BD95A2AE3BFD7B8F47001219772E4136527CBAF2AD488E91CA3315D940FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185836, "uuid": "b1c7b293-7782-4909-a6ec-1287dabc8297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185836, "uuid": "9f134b89-1757-4c0b-896a-8246b991f159", "value": "3072:u+STW8djpN6izj8mZwk72RH7UbBgNcaUTLLHjezfRh3/Et986+WpC:T8XN6W8mmk7SUbMUbjeRhPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185836, "uuid": "78fb2904-50bd-48e0-bb7a-60fbd9badf30", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185836, "uuid": "026fca6e-da7b-4459-a7ed-9aaad4eabe9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185836, "uuid": "48825941-b1b8-41a2-8d68-91c6b6cfcfbb", "value": "7db33185f1eb10c9ad3a85f38c436d65975b2ab20887683898a27fa5fb7864fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d63cd4-cef5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680178831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178831, "uuid": "c131a31b-9fca-4533-8315-7d829ecf3f1d", "comment": "Malware payload (Amadey)", "value": "fe19f261e1cbb957fd01caafa487d950", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178831, "uuid": "519e458c-f771-4ba4-aba6-d450e873f7c7", "comment": "Malware payload (Amadey)", "value": "7dfaf9d11a1e937c0f4e4a7dbea5998eb889e2475ecb6f1030efabab42f0035b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178831, "uuid": "43f7b7cc-aaac-4485-ab5f-3d2ef9b959b1", "comment": "Malware payload (Amadey)", "value": "67b14352c75d694ce497a21805dbb97eb9c36178", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680178831, "uuid": "3a0be593-92c7-438a-87cb-fca96c061c4b", "comment": "Malware payload (Amadey)", "value": "5585882fdd6e86327c7e401029974a40b7701df9e4808fc1b356a54b60ce0040d67e6c042e458d8bd8fc1dd5f8aa92a0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178831, "uuid": "b461cf9a-45d2-4936-8984-79fab521c84f", "value": "T1EAF4695F11415EDA84186DEAEB558298C6EF2106FFF4717DC81ED0B06A2E948CED38E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178831, "uuid": "762540ae-1916-4b18-94f7-10ef455ee43d", "value": "3e081a820fe6244a01fb0c6235a1ea08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178831, "uuid": "6bae62c8-67b5-457b-83d9-53724b5ef43c", "value": "3072:j9Jc9Wqc6xErS0uNtCK7gOwHQ8htjLh+eRhIHEESLUc5dqJEk2tsps2OZYTo:RJm7KS9uK7gNHPtjLhr0EEFREkGEgGTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680178831, "uuid": "8598b9fd-6282-4cd9-89c0-1c1697bc6136", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680178831, "uuid": "6699996d-d778-40d9-8f96-6c26d9a4eff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680178831, "uuid": "34cf96e8-810f-4869-96f3-a249ad609cc3", "value": "WindowSetupLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce793087-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680161455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161455, "uuid": "f47f4cf5-bca7-4672-a7cb-8c2fa3fb65b4", "comment": "Malware payload (Vidar)", "value": "54d523a588b0a7e79dd59dfe6086ee99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161455, "uuid": "04d721d9-d8b2-4a07-9f7b-6bc82bda9bf7", "comment": "Malware payload (Vidar)", "value": "7e311d90455c95a32b9d46d4ac1656ff056acf966885c1da99027cc6bdda08d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161455, "uuid": "88c58d93-50b6-4e5e-b344-66e0687fe4d9", "comment": "Malware payload (Vidar)", "value": "2c29d86cb2a891f1a35f5cb79a8672e24e6bf631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161455, "uuid": "1e5d4430-4d2a-455d-b8bd-a28b7e55d61c", "comment": "Malware payload (Vidar)", "value": "c10dbcb632b24fe26e3d4bcac0ecb8e97ec15ea1f9220acb83e5ba6c0a8da87eb4a633692a529b0b2b6806b9385b990a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161455, "uuid": "a13b3cdc-503d-4841-a4e6-d2d1ff014bd6", "value": "T1A244D121F3D1C47ED95B45790811DBF84A3BB8725B268ADB2B441ABE5E307E28B31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161455, "uuid": "9c551d8a-1021-4613-b0f6-38f8bbd3f065", "value": "2222fbb8197512ba6814617787ba14f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161455, "uuid": "638cae71-3469-488c-8bed-24c115cdbdd5", "value": "3072:I4EYtmo68Xssjkh9cAcCLN304NjgaZNeIWaHWejiAubrmA0I6FbJOJLyuRkOBJJb:SYMossjkh9cAPLKmxZNeItkEb2NLJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161455, "uuid": "17f4cb38-940e-488f-b17e-c64b86cfa850", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161455, "uuid": "06ec94a2-2123-490d-b036-83f594fc5580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161455, "uuid": "4508ef88-466d-4de6-a2bf-40712639e7d7", "value": "54d523a588b0a7e79dd59dfe6086ee99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a1bd1d-cf26-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680199957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199957, "uuid": "bf669166-085c-47ff-9a8b-2b3e229b2862", "comment": "Malware payload (Loki)", "value": "3d236d99c28f06dafe221fcd14237baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199957, "uuid": "8a8f7a6e-4728-4d23-8476-b0623d139d7f", "comment": "Malware payload (Loki)", "value": "7e78fb488448e47f877769b0b27f93d13ba8db13af442c0d8c3df58f44bb34d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199957, "uuid": "3574557a-e045-4b61-8833-7a1a52e2f898", "comment": "Malware payload (Loki)", "value": "c138dc3e089984703385284008256e7d54a6992c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199957, "uuid": "734b4f20-5501-4023-bedc-fa15985e7465", "comment": "Malware payload (Loki)", "value": "ecc83d4148388b8511f3a5245066b864531d1b049657d359ae98b7e50c4ee12f44e9ad56f3b10afd9338c5c0888778c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199957, "uuid": "aab02146-4252-4712-b55d-8548240ba058", "value": "T15AD4F10832EDC20DD026D77AE1E4D1B063B9CD98E662CB170FCDBCD7B38A79A5525096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199957, "uuid": "af4b47be-2477-41a0-9388-29c82350f895", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199957, "uuid": "042f4335-4cb7-4455-9580-28afed1383e6", "value": "12288:CJ1lzg6sBdX5+t4I8hLxb7OI2qu+TMFE5q2hzV50sKnnX4fQGHimOMt+:CJiBdJ+V8hl7iVGpU4xHimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680199957, "uuid": "b9eec539-b8b8-4b0c-bab4-7eed60846201", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680199957, "uuid": "95ebf7dd-1634-4aca-9f73-ff51b77aab3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199957, "uuid": "e706687a-36c7-4b34-a56a-82399003ecb6", "value": "3d236d99c28f06dafe221fcd14237baf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04a6092-cf2b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680202233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202233, "uuid": "5efe9092-68f3-44c6-9835-14aa68efb18d", "comment": "Malware payload (CryptBot)", "value": "a0543f4768b6938e07393baa1301a3a5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202233, "uuid": "3be911ce-f404-4a86-b845-1dd87ec142fe", "comment": "Malware payload (CryptBot)", "value": "7ede0b1138f235629f0e3539de7f0b225b9e9f9ca4855aca0e9ccaeab0731bf5", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202233, "uuid": "1a488b04-6a90-419f-b50d-4511aca6df9e", "comment": "Malware payload (CryptBot)", "value": "a2fc8528c2b25145f4f87265ae229379839d8b79", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202233, "uuid": "0f8cdb67-d412-4018-b57b-40a8cd67ab1a", "comment": "Malware payload (CryptBot)", "value": "e9828cb053fb75907698b55e8afd62498341b1bedcfac1045587cfc651618b4607a99e01baf78abbd9d71e727f5b1590", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202233, "uuid": "d698e322-e23f-4507-891c-a95d99911281", "value": "T17866233B239411A7E8D08D31A937FD6A72B5BF564A41ECBD28EA3DC729334A5F111603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202233, "uuid": "9618c1d9-489a-4e4b-a39c-29b2469018c8", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202233, "uuid": "366aecac-7465-4ba4-98d6-551317fedb7c", "value": "196608:RkAYBdNTUeMyEg/CN95K1o8TE4eOnTGcwdb:Rk5dNo2Eg6N95ghE4lTKdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680202233, "uuid": "80b2d4f6-72da-4256-8f81-e618b22cb768", "value": 7109632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680202233, "uuid": "8da33468-caff-4a66-8122-f6f9f27a6b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202233, "uuid": "29128b72-a1fb-4ed4-a6a8-b4f717ce8f98", "value": "a0543f4768b6938e07393baa1301a3a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe415cd-cef1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680177375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177375, "uuid": "96d3a8ce-47b2-473c-b1f4-fa40068ca8eb", "comment": "Malware payload", "value": "e791286741e84294768f0e7aa638dd30", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177375, "uuid": "f5cca888-9a9d-4a79-bd4a-f0142430cf5e", "comment": "Malware payload", "value": "7fa315da449b28029d277ddd4a5568664f52f56ad234d6f43949533e9d4a6e6c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177375, "uuid": "5414d5f2-b3f5-4236-9df8-c5454e609990", "comment": "Malware payload", "value": "b18fa167a57fe39d9b0a92792c7223c69fae9a17", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177375, "uuid": "374d9908-2af1-4f0c-abc3-de077918ad36", "comment": "Malware payload", "value": "91f24d42265b18743c8036cd589a767c4dbd80aea82106fb5952f8e244f41ea10f44ba89fc6d852f5d206de3abd62418", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177375, "uuid": "602155ec-c622-42da-8dab-92820496919c", "value": "T133450214269DD10BC816C37E81E8D2F033B6CC99D251C7927FDDBD87B38E7AA1A25096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177375, "uuid": "76adedd3-9afd-4a16-b416-90f15b5d484d", "value": "24576:Sb3yVAYp4DS9qw/jE9cPi9Dt8nw2fOEevimX:SDyNpDqw/jETDt8nRmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680177375, "uuid": "b369044f-a7d8-484b-86bb-e1ec8d9961cf", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680177375, "uuid": "0e3b3b99-8653-4cfb-b205-c895c710fe7f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177375, "uuid": "b49cc0ef-e5ca-4366-820e-3af76ecd54b0", "value": "nORDER_PO.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b700f3a-ceeb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680174603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174603, "uuid": "33605125-4aa1-44dd-ab62-0ab5c861c9bf", "comment": "Malware payload (AgentTesla)", "value": "5dcefd1c13cf257168c014edad94c43b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174603, "uuid": "1ceb7842-82da-488d-bcd6-57d448e30618", "comment": "Malware payload (AgentTesla)", "value": "80b6e703e67ace7480854fa2e005495b86c53b0f2afd72018d0c77bf9fd43605", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174603, "uuid": "a1ce396d-d7e8-4016-80a3-ef63edab9a79", "comment": "Malware payload (AgentTesla)", "value": "a730e4d4d2a3ea070c85783afab4578e756758c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680174603, "uuid": "7e0a48be-5749-48ad-99ad-1901cef9f1a8", "comment": "Malware payload (AgentTesla)", "value": "940ab96dc8c58c06c1e76d604afe8a615b36b245e3e5d876eaf6418da4daa5a65c644c8a14d23652567560199bd65699", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174603, "uuid": "1b5b2555-0a14-4ffe-8bcd-a953123cdbe8", "value": "T1F3E401143BD8D60AD116C73EC2E5D2B0ABB6DC95C666CB230FD9FC97B38B3965520086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174603, "uuid": "a288f12f-f065-4f0f-91d3-3767cf8a8799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174603, "uuid": "7db3f1a0-5d96-4ceb-b202-3954fc8e4d74", "value": "12288:vvbimOMt+DNSorzsb6WFJv7IhxUySBmR9MLrZSowdhI6Bjq:vTimXyyFJv7IhxgBmsShdhIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680174603, "uuid": "f7e7f6ae-0839-453f-8920-2b56fbac258c", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680174603, "uuid": "2c7e53e5-4a4e-4093-a986-91119a97710a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680174603, "uuid": "d30503c8-6156-4a74-8166-a4d02db7f1e7", "value": "DHL_AWB_NO_#AWB 4507558646.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18561681-cee0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680169739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169739, "uuid": "a537ff97-1d70-4110-9ec9-8d2b04377ec3", "comment": "Malware payload (AgentTesla)", "value": "bf7e3ea1bbaba155ce9079dc9e959501", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169739, "uuid": "cea28fdc-6023-49de-8e8a-8c86ae90c0a2", "comment": "Malware payload (AgentTesla)", "value": "8107f9ab5c5030afbbbebfd98280556cc08697cffa66d45548c5e012209d9184", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169739, "uuid": "b932b986-c6e8-48af-97eb-42e5dd63da8b", "comment": "Malware payload (AgentTesla)", "value": "be73007a9ea47dcd70ad4c17f239a78c709829d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169739, "uuid": "1d57b7ef-57e4-4cfb-8a21-59ce62ef4676", "comment": "Malware payload (AgentTesla)", "value": "d401560e297cc58b5c90fd22e24921c3948612823bfabef79730f617fa00e3d2fa5111f180be8f44e6c0ac13e64c1eb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169739, "uuid": "720e184f-14de-4b75-8d11-1e578663b01f", "value": "T189F47D7C1AFC8556E039D7754BF04C20F7EDB4177A36DE1E79DA008A0A26A42768336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169739, "uuid": "1dbeded3-dac6-4f2d-b72f-b8b3f28b4972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169739, "uuid": "12693c4c-dbe0-41f3-b59e-ecae01f9a97b", "value": "12288:hxBZWR942mwMHGtGeIn+ihCMGkU0yywVn3:h1WR9lptrNKCMGIwV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169739, "uuid": "3c8a139b-05e1-4943-b76c-e2517d0195a5", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169739, "uuid": "a6f3229c-a912-4411-b816-a994d77ec717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169739, "uuid": "40af484a-554f-4420-867c-56dc3c0126aa", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75e8f66-ce96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680138223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138223, "uuid": "a2c45db0-efbb-4bb7-8235-37a97543193c", "comment": "Malware payload (Stop)", "value": "55af7b26c924d425ae47a074773da342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138223, "uuid": "95b5f0cb-a46b-4404-98d2-51ffe94f89b7", "comment": "Malware payload (Stop)", "value": "816b9b4a7df898e3393af529fd21b705ec010276986b0d55440aad333a4fa15a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138223, "uuid": "e9363381-32ae-40f4-9f4e-eff13e2fce92", "comment": "Malware payload (Stop)", "value": "7de4967d371d795e93d229505889c9e97d47f42a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680138223, "uuid": "a3cc19e8-015f-4b58-99e2-e84d7e11b08b", "comment": "Malware payload (Stop)", "value": "aef345bf51946889437f1fc8f860bf50c1c46e625f3f2255108a24c9318db9d6e04473c4cb91d3521c8c41c4266953a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138223, "uuid": "adc12d62-480b-4fa6-990d-d3a87994fce7", "value": "T119F412327281C072E95A017D0821CBB95A6A7870DF648FC7BBD426BE1E35BD25D3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138223, "uuid": "da9a4b2c-9251-4740-ad58-bf0416df54f0", "value": "fde2d3c5c6b5080c428e56f6f2289988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138223, "uuid": "5c6742d5-3fa8-4304-b541-7e169d7d8ab0", "value": "12288:xHxUZ+JKmbGt0bqJfE3FT21bCFbkCUXiun96WSXdu+cQxi2/AheSL3:xH1KSGt0biE1q1AAiHBXw1Ii2/AASr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680138223, "uuid": "cf074db9-1eed-46a4-bc54-e1c5454c7430", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680138223, "uuid": "bc330d6f-86cc-42f4-ae27-118357558a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680138223, "uuid": "30e4704a-d641-470e-9426-95cf43884e69", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19ae3c2-cefc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680182022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182022, "uuid": "1f04b84b-5f71-4fb6-8225-02d4d6477dc1", "comment": "Malware payload", "value": "a57ccca8909768bf54d05c22493bd297", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182022, "uuid": "a8cdc6e0-45df-4933-a7f7-2e2111042312", "comment": "Malware payload", "value": "81dabd77be32476493855f1db97c5724b6f0797159ed5f1ee0b1a7f833e68da8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182022, "uuid": "712e9caf-fe5c-4211-8884-7d67d281ee90", "comment": "Malware payload", "value": "41b22fe9bb59846201a5b4d88b420a8ee14205ea", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680182022, "uuid": "fd37e7e8-c9e2-4c84-9694-0e8b93222660", "comment": "Malware payload", "value": "368f6acdb7f9c3cc6970b294b662f77c7b5a8791e11a79894dca9822c0719f69987b6b14758258ab51152fb7e915c6d1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182022, "uuid": "43a2495f-40b6-4f7e-9868-34694310830d", "value": "T18A34E0073604CF43E404CBF9BFC79D9A5706BF05AA8236DB2151379F2F741969A8A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182022, "uuid": "cb12e0cb-0f88-4aa4-ae27-705dda423b3d", "value": "6144:daFJkKXiDU7w5ZOT+8Du4RWP3Bc3wjzKkXtBaTdP/9IDmLNM:daFiKXKnOu4I/B4r2tB+7IDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680182022, "uuid": "cac3d0b2-f478-4a51-b5d4-25945ee1b8b7", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680182022, "uuid": "9824e4b8-f649-4c66-beea-f81e7eb9db65", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680182022, "uuid": "eac47452-3edb-41ee-b177-9d7124853d1b", "value": "Order-CHWU2SI22-233534.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf777987-cf3c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680209560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680209560, "uuid": "83cabbf2-b8df-439d-b356-67dac46c571b", "comment": "Malware payload", "value": "83cba55f180b0c100935137615e8d296", "object_relation": "md5", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmoothOperator", "colour": "#ABE325", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680209560, "uuid": "716b5c60-b51c-4182-be75-2e5340d7f153", "comment": "Malware payload", "value": "82a2dafd6ce594f2cf8588f32585c71be2180fc4cf9a144e300b1692f3de5807", "object_relation": "sha256", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmoothOperator", "colour": "#ABE325", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680209560, "uuid": "eb8ab547-3219-42a5-a087-0fe990909b8d", "comment": "Malware payload", "value": "7a1d41c8e9e4bd19e0e360ec17e30c38e4f9ca0d", "object_relation": "sha1", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmoothOperator", "colour": "#ABE325", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680209560, "uuid": "999627d2-6ef8-4a39-abc3-ecb6cb0af220", "comment": "Malware payload", "value": "e278731ee90ee66d591f925beeac37cd2145bbe086d105777fca90fb9159ddd816e3122e9ca0090a58fdd09f314dfe5c", "object_relation": "sha3-384", "Tag": [ { "name": "3CX", "colour": "#9699E2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmoothOperator", "colour": "#ABE325", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680209560, "uuid": "71b9e705-dadc-42b8-b321-0b5d5cbd9317", "value": "T153547C1973A90EB9D4A78139C9569A42E7F17C0603A0CEDF03E086776F636E05E3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680209560, "uuid": "ce05776a-9ac5-47cd-b35a-655eef3eb7c1", "value": "473de3ef28aeb4566b679b4090ba8204", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680209560, "uuid": "926d4d5f-903f-4513-8d15-1686881bdc60", "value": "6144:Dv3NBiAcCwl3BcptSR0rDlGBGuN6c3rX5e:zNBiAElRcLSR0rDl8GI3rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680209560, "uuid": "cd98f986-b96e-43c9-bfce-5f0ff0e8865e", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680209560, "uuid": "81c3ef33-7dec-4953-a165-5205e2263f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680209560, "uuid": "ca748091-a910-4186-b19b-ab6c0f9fafd4", "value": "third-stage - unmapped.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523fc097-cf07-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680186586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186586, "uuid": "40079559-57e6-4756-b83a-7d2022e811cf", "comment": "Malware payload", "value": "4a0e38a9bc5b6b5bd4bd89719c487ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186586, "uuid": "005aaebe-e74b-4cea-b8cd-6ade1ba3cbe3", "comment": "Malware payload", "value": "850b44b363d5f13db8495297954350ff1dd398a0bbfdd57972fd77bc12d43b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186586, "uuid": "7b3c9f05-bc27-40be-a687-2ffb0b515eb3", "comment": "Malware payload", "value": "e16c61bb82db690a63f29088d4ae621d9dc41c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186586, "uuid": "c561f8ba-a7b6-4d27-b1ba-d68d17b3a3a9", "comment": "Malware payload", "value": "6df95d553d7b5c0cac7668b88038f6b5898c1e347612d4dfa3d754cce9bd3a04d4dfd1f99685253c8f685df5efbf18c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186586, "uuid": "7fce533f-f7fb-4632-b1e7-b6638ebfc5c2", "value": "T120E43A1BF7B385BDC52BC13487A7D772A931B82942357A2E2A54C7322F20D509B6F724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186586, "uuid": "0aa272ca-ba80-409a-9cf2-08c317be13b6", "value": "9e9652bd0aeed2dafff4f699303e1318", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186586, "uuid": "276eb627-9e47-4eff-8efb-75227fc4c527", "value": "12288:dlnT3FxobeSbrVExFjc0mvLmxTSMamb/w:dlnTFxobeSlExFjc0mvLmxTJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680186586, "uuid": "cf00004f-e7fe-4b45-8a0a-eae6a3cac525", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680186586, "uuid": "0c31ab07-4479-4532-86e1-d0eae5abb119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186586, "uuid": "9c74f630-07fd-4edc-846f-efef36285342", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d58664-ceee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680176102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176102, "uuid": "2e23386b-f081-48b2-b60f-91c8fdaaaec7", "comment": "Malware payload", "value": "9b406b9ce0df2d7d88eeab56e14b333b", "object_relation": "md5", "Tag": [ { "name": "3CXDesktopApp", "colour": "#D4E4BD", "exportable": true, "hide_tag": false }, { "name": "DecryptedPayload", "colour": "#D37EED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176102, "uuid": "2658472c-7a64-4cc2-bafa-a1080ee930ec", "comment": "Malware payload", "value": "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7", "object_relation": "sha256", "Tag": [ { "name": "3CXDesktopApp", "colour": "#D4E4BD", "exportable": true, "hide_tag": false }, { "name": "DecryptedPayload", "colour": "#D37EED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176102, "uuid": "fe5c9808-155a-488a-8628-5fcc33d576a4", "comment": "Malware payload", "value": "3d4fd9a4da428bed3039de61da8f5347ac0c27f7", "object_relation": "sha1", "Tag": [ { "name": "3CXDesktopApp", "colour": "#D4E4BD", "exportable": true, "hide_tag": false }, { "name": "DecryptedPayload", "colour": "#D37EED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680176102, "uuid": "bfbb8678-75e6-4163-847d-bbb1509d17a6", "comment": "Malware payload", "value": "372994333d398499d41f8f8fc17cdbcecdce57299ae3a86d41f8527f6d49f5f175096bd9e8205fe2e7741b0a06b9dce4", "object_relation": "sha3-384", "Tag": [ { "name": "3CXDesktopApp", "colour": "#D4E4BD", "exportable": true, "hide_tag": false }, { "name": "DecryptedPayload", "colour": "#D37EED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680176102, "uuid": "00dc2881-3b18-4e45-8399-79800eed6d03", "value": "T1B5547B1977A50CB9E4A7823DC9579A46E7B17C0603A0DADF03E0026B6F237E19E3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680176102, "uuid": "f5d85618-59a1-4560-accc-527e70b3230a", "value": "473de3ef28aeb4566b679b4090ba8204", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680176102, "uuid": "e4af27bb-ca44-4fc3-bfa2-34f722f1d54c", "value": "6144:jv3NBiAcCwl3BcptSR0rDlGBGuN6c3S51:TNBiAElRcLSR0rDl8GI3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680176102, "uuid": "4c3dd78d-8646-46c5-8b58-022341860b29", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680176102, "uuid": "0c5af914-0ad4-4396-9b4e-14586640359c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680176102, "uuid": "05cb296b-14f6-4eb4-9455-475711889c5a", "value": "164e9b60000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887fafd9-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680196985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196985, "uuid": "4a8cd5b9-b459-440b-beed-4dbcd8ffd736", "comment": "Malware payload (Formbook)", "value": "25386b5e046ae4643850baa95857761e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196985, "uuid": "efac629e-71c9-4aad-914e-29ee59dfdbdc", "comment": "Malware payload (Formbook)", "value": "858365376ff602f13f39e9cf030896fdffb783b93926c7b48c227cd47ee1ebc7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196985, "uuid": "c403c556-119f-4c37-9b52-86ceaa61f9af", "comment": "Malware payload (Formbook)", "value": "5d24bf621449ac8c549cf243970b6e9e20eb17be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196985, "uuid": "39264b5e-7c42-4fb7-88fc-0d9c645b2694", "comment": "Malware payload (Formbook)", "value": "2417c4b747be1c3e0f578234eb7c3444bece376484a6e3821ae10f4adb1b240fd05cd697b45a98617f8777b2cac0f240", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196985, "uuid": "4a28d739-a782-4ab4-a5fd-d3e8758a2095", "value": "T11E251213EB448E4BD80283B8AF9369C9530F7D463ADAB98321017B5F2E76F61E54325D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196985, "uuid": "786366bd-73e2-43c0-bfd5-577697eb904c", "value": "12288:PZaFiKXKdDArko7aqUu9VneKArcqUu9VnegnqqUu9Vne7bc+M+uUWZCLcVxcP9S3:MLKdPu9Vlu9Vqu9Vd+MXUXLcVxcPD/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196985, "uuid": "7fa96b02-1433-492f-aa9a-fd52e676de03", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196985, "uuid": "1e830452-dd20-4ae3-b774-03140390beea", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196985, "uuid": "83d33354-351e-44ee-b47c-aa51b8884c5a", "value": "Original Doc Ref SN02853801324189923.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35390ea1-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680161197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161197, "uuid": "0f191f56-5abf-40d4-a618-33c9d01186fb", "comment": "Malware payload (Loki)", "value": "55f4f73b8cf7ff1d810db6f195beac3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161197, "uuid": "78edc9f1-5e12-4eb9-b853-d9b52b622220", "comment": "Malware payload (Loki)", "value": "86c9b651da31bcefae2da9040f991b5435c0e401abcd63dabfe75a4efcbb3938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161197, "uuid": "9b2a4dda-1a85-46e1-afe4-9fdbf2ea87eb", "comment": "Malware payload (Loki)", "value": "3151f5a9668f6c1efcf19c2d636e3fba10340f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161197, "uuid": "b483533a-3902-48e5-918e-a9e4ed24e0aa", "comment": "Malware payload (Loki)", "value": "134e2d0cc16b25103ad6a0a61fd879d1f35eaa918640175049afadd9fd3aece3a050d923518a72e9df805f52c0aaaf84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161197, "uuid": "703d91ce-71ed-4740-88e6-29a23d14015e", "value": "T11ED4011032DC915AC669077A81E1C2F163BDCCD8D76AC7A71FDABC87B2CE344A425297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161197, "uuid": "e7be1ad6-7ce1-45bf-a372-811366465616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161197, "uuid": "65f0a630-6fd1-469a-8def-87cb79116296", "value": "12288:KeJ/sId50h7Vb8jTMPMv9d9kDiOVHO21hIWskcgUvKrQjzuimOMt+l:CYHbj8iOHzhIWsUoKrguimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161197, "uuid": "57f8d174-6e58-42eb-a3f8-f9981c8e7273", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161197, "uuid": "409a92bd-8fef-4f69-9a74-79cba3151dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161197, "uuid": "278cbc57-bb40-41c3-961d-76d4a96fbf0c", "value": "FedEx Invoice Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e893580-ced1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680163495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163495, "uuid": "44c1a772-d289-4be0-80cb-967d4b07649a", "comment": "Malware payload (GuLoader)", "value": "6f2c2220fcdbb75d33aea719a1b55b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163495, "uuid": "82a1dde8-0f04-420a-a37b-b05e0b8be5e7", "comment": "Malware payload (GuLoader)", "value": "86d7bb37384646a755a03c2f6e743483ee40d5af6f018824e89c54a9308ceecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163495, "uuid": "2bd67b83-3326-403e-a6cd-b5338f210118", "comment": "Malware payload (GuLoader)", "value": "9246276df38b3c2dff316dd432928bb709caf88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163495, "uuid": "e7d0f967-60c8-413b-882a-46344befeffb", "comment": "Malware payload (GuLoader)", "value": "7acca0c87c3ce7de6d0502c5b29b7e1588b0bba37a6a56c0ae7b45373e3e756c3c5340db5cbb9f72898efa0830967282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163495, "uuid": "70fec5c0-0bcb-45e0-a3bf-93b741e1a291", "value": "T15B641203B732A8A7F56613B2097B1F55CBFA8D6421B82B471738755AB972243E31F342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163495, "uuid": "524140f8-5750-4412-9444-b0688445b0a0", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163495, "uuid": "5c22ba02-22f2-432f-9d1e-5654934ed8c4", "value": "6144:H6+/tVwcQS/Y57aNJzbGA8n6qmHRdBdGHyfM2gNaVJb05cOYJ0wNRHOxI7TlSPLZ:PnwcQS/K70JzSA8neGSfLgNUJkYWkKIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163495, "uuid": "fc9001c7-86f0-49ce-ba63-bc2b19a88333", "value": 321598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163495, "uuid": "5293b12b-3b07-4a08-af94-93104f980389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163495, "uuid": "24ea97bb-045a-4153-8e93-27eb2fc78bd5", "value": "ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de5106a-ceda-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680167252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167252, "uuid": "f95cf85c-13f3-4ce3-bd39-62980e49fd61", "comment": "Malware payload (Stealc)", "value": "76918f971902e148a549c13ba50a96fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167252, "uuid": "085385a5-44e9-4126-8b3d-27981bf4db7d", "comment": "Malware payload (Stealc)", "value": "86d7dbb438477b8334304d10d719d750bf379a10e2fc02a5e29632e2ed3a101c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167252, "uuid": "c42f71a4-63e1-49c9-845c-4b5833deab7c", "comment": "Malware payload (Stealc)", "value": "431f6d87cd84c6fdcc2e389c1f5dd7b9d1f677d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167252, "uuid": "34a2a2eb-7f22-4cd2-9dd0-c9c227d02647", "comment": "Malware payload (Stealc)", "value": "1f467020cca4d2d7a1a4f259c311f5fb36caea5a41b44febfa21e62750e89de7d2ac95d02c9bc95ebbf12185acb99f2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167252, "uuid": "eca021c0-9003-47cb-87e4-94d8b5b22843", "value": "T12D346C169EFC7830F22347368F2EC3F8261EB8617E15BA5E56555A2FC5B43B1C2A2314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167252, "uuid": "cd94ed08-b2cd-43c3-a731-6e2ca4e1ea0b", "value": "09829a76b54b4835c677dc6fac4ef621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167252, "uuid": "b5230e15-447a-4aad-b042-09af660e8ddb", "value": "3072:/pkFzFqvmq+Wz33lTVbs3AilpQlVE1TmI5PPLWWsjMSgrEA7yUbQ23s0:/AAvmnU33GWVE1TljwjfgrEsyUbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167252, "uuid": "a9ced18b-cfb1-4e59-88a7-53e3581ae639", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167252, "uuid": "30dbc51e-d67b-46af-8766-828576e4d24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167252, "uuid": "19a53fd7-b6d8-49f3-9799-a8eb4df296f6", "value": "76918f971902e148a549c13ba50a96fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c80553-ce92-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680136314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136314, "uuid": "542329f4-c96e-41ec-afef-c08fb0268ead", "comment": "Malware payload (CoinMiner)", "value": "7c708907eda3dd79b069d13a53867ab4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136314, "uuid": "efbe7b71-009a-4f7c-addd-4dc0141e2a55", "comment": "Malware payload (CoinMiner)", "value": "87f90ee5b488898d9f7d3e6bc4d776cf8138b14ddd9edff1f45f43f48b7cbbfa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136314, "uuid": "0d5576fe-bbd0-460c-bad6-f216aa6fb9a6", "comment": "Malware payload (CoinMiner)", "value": "51d7a2de3834379dd3e53cfd905e5fa77568783c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136314, "uuid": "f17ebdae-3bf0-4465-8fda-6e6a46ca57e2", "comment": "Malware payload (CoinMiner)", "value": "aca06c8766d52e78c1bbbfbc016d831822be0f510d0db133d38be83040e40433636c9cfac3f10a4dc7f44e3dd4a9aac4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136314, "uuid": "e24b99c0-2d62-4eb5-9368-44eacfdcf937", "value": "T1A0D5F192AB37BE65D6C56FB82899021E41536BC8EF24D5276532BF3E002D3FF55A2403", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136314, "uuid": "b8acd549-4892-4171-80a0-7438d0d9081a", "value": "dffc733bd2c697b7071c344d16ebbbb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136314, "uuid": "5578fd5d-d2b1-4f61-ab39-08bafff9f4d6", "value": "49152:AXVMRH+D/al5mau1wXRIzlEl7fXJTGDXdLvkLvccVSOEmvjBdH3f2vEs6jg9egdl:PRH+DymauoRIzlExWRvkLv/VSO7Bpv2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136314, "uuid": "c44354dd-fcb8-4f04-849e-1686fe9ab078", "value": 2817419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136314, "uuid": "c88b39d9-90bc-4310-9759-18e7481947e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136314, "uuid": "7e97209a-6693-4543-957a-46fb7e862d57", "value": "WinRAR Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ceba614-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680198308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198308, "uuid": "513dee2f-4720-4897-8228-2bd2446af535", "comment": "Malware payload", "value": "50430be7e76cee93bfb67f638c45db24", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198308, "uuid": "d97f571f-21e0-4177-b157-af81a6f80680", "comment": "Malware payload", "value": "88c4fd970ee45f12ab4b95370a2ceffa64dc27b0da5e181f5755532aad7010c5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198308, "uuid": "f5ceae35-ea91-4bf0-b498-c27af77a8f47", "comment": "Malware payload", "value": "f367d92793ad4a7b6765a5ee2183a418c34c10a9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198308, "uuid": "71f94247-c9e5-4158-85f3-d2485d342470", "comment": "Malware payload", "value": "4f5299480006f70ff45ac125edc453a2f831fde9517e11327963a5a2bf6a50ff1ea695de94b569876dc943fb92cc90f7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198308, "uuid": "09b380a2-dc22-455c-920d-b0c597e86bc7", "value": "T1F374514075E9000C76E369438FD7FADD2B3BE5DA94386E2E48CC494917DEA88C61E7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198308, "uuid": "666dd838-2247-4810-8631-25b1ef18ce01", "value": "1536:j89r/aDcWJwG0mtvR/Eg5lq1laktrO8MmxqMsTMBhuiW:Kto/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198308, "uuid": "56d4a9e5-dd3c-4fa8-a36d-5276e76e2aa0", "value": 347530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198308, "uuid": "823e85ac-13c1-494c-b724-87a9eabe1fa1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198308, "uuid": "fd3812f2-1c42-4570-9795-80331fa3f56e", "value": "PDT9377823-735363563.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b524c3-cee3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680171072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171072, "uuid": "767e397e-4a81-4c79-9546-92be74e824cf", "comment": "Malware payload (GuLoader)", "value": "0160f8498140d7e9acdb092937e314c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171072, "uuid": "e45181a8-94be-4f0e-8cab-306bb4d9ebe8", "comment": "Malware payload (GuLoader)", "value": "891abb3d1264272bfed2a01a198330c9ffec43131d0e547b4bc3ed27e1d509c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171072, "uuid": "089a84d2-dc2f-4088-83a3-594c8c023ead", "comment": "Malware payload (GuLoader)", "value": "55e786b28173122ebd1023adcec916b4fe517cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171072, "uuid": "6139e8cb-0e3f-4bc3-9b54-6aa156d7191a", "comment": "Malware payload (GuLoader)", "value": "5d5cb8b039bfc924596bdc7b3286cb73fabc8dd750373af273dfeae3508fa3192ea7ca798bdaa443152a5b44f944e45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171072, "uuid": "f6fc974d-2c58-4377-b72a-a04d09c36c05", "value": "T12905127233109C42E5B1327F0DA6E1396BE1DE5A818D570632DDBE0FFCA63D25C1964A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171072, "uuid": "4cbb8339-a21b-4e34-b4fa-15c0c10de0bd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171072, "uuid": "bcd3b8bc-583a-4eac-a4e3-5cc863bcb657", "value": "24576:NuxnYTWRWSxVZqOEzbPDzse2IWZDNjpg2IRezTw:Qh3W8ZqOI0z9lNjp8Rkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680171072, "uuid": "cbb077a9-b674-4744-a4dd-b641480e37f6", "value": 833818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680171072, "uuid": "ee3bde61-6a01-4288-8598-9300212aa73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171072, "uuid": "e82eda47-f323-45f5-ad52-0ae6313fbf5c", "value": "doc_invoice_no20233004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286c3cfb-ceb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680150009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150009, "uuid": "a52c9397-68d1-4a50-9f4a-7accd9a72fbc", "comment": "Malware payload (Loki)", "value": "2c5cf406f3e4cfa448b167751eaea73b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150009, "uuid": "de030212-68cb-40bd-8231-4e5224927d7d", "comment": "Malware payload (Loki)", "value": "8924eb9498e658c131a56354ee7f6577e51e028a518b614a027911d2cdf4e279", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150009, "uuid": "fe30bd54-2212-4af1-b8a2-64daacaa1f33", "comment": "Malware payload (Loki)", "value": "667c5c6660607276bc76af4c87dc2daf67605115", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150009, "uuid": "751609ec-76d0-44c9-98c0-25313f098c01", "comment": "Malware payload (Loki)", "value": "528a531253783c96e9fbe86976bb1dd9a816901acdd42af86dd8c9c40747ae5b877a7d594e1a870dfc43f918816dc026", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150009, "uuid": "4a515596-2c29-4afb-88cd-02cbf1f642d9", "value": "T193A2E2565B8C4C61F26AE8BB875DA00E18BCF23234C215C5BD9DE2753B7D14E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150009, "uuid": "167ea576-297f-4b0f-aa53-e6ca8dd840d6", "value": "384:dVKhC+i3i+5C0+L+MB8SCBnQsDNvbtdpt0mlhRZBuW/wnCYqs3MUN3tnz/ZzNZPq:dJhC00VCBnQslguhLYWICYqqN3tnz/ZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680150009, "uuid": "ab4a682f-5ea4-44e1-9c54-a3a16bb107d2", "value": 22690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680150009, "uuid": "ef8a32d3-54f9-4720-8ecd-a65c6e483fcd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150009, "uuid": "c5dcd557-2bcd-43da-b17a-963db1a09f6f", "value": "2c5cf406f3e4cfa448b167751eaea73b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8997551c-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680196987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196987, "uuid": "bad013fc-3da6-409c-a7a5-90da1ba16c05", "comment": "Malware payload", "value": "1a3aed19d11c3f3e813b2a840845f0cd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196987, "uuid": "a808e345-481a-48ca-9d9b-620ce9796e83", "comment": "Malware payload", "value": "89aa611e10dceb864213a5d57fdddcd6b23a4e91c7c303d92eca0a311cf70cb0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196987, "uuid": "32dbbbcb-d188-4aff-a0fc-0eedca678e67", "comment": "Malware payload", "value": "0d619c24057593beff3dca04ed57e2c1304a598a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196987, "uuid": "932f89c9-d5a8-44dd-95e0-3241531c874d", "comment": "Malware payload", "value": "4e364e3f09c4711b177ca4642d70eec59a6de4a9c5c1a8b42c937ec4e482f7ec5dc752bb14d56b46cf6275fafb6d311c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196987, "uuid": "0938b098-82ea-4042-bb05-420412ce3827", "value": "T1F4351213FA409E86E085C3B09F972DD5830DBD42A3A728831648B75FAF717A8799724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196987, "uuid": "f68f4ddf-33a5-4642-8d25-de8ae69241ef", "value": "24576:7LK/SSMMednE6akAmmjmRakAmmjmf+MXULHWB222222222222222222222262bAS:7LK5Mhaaoeaaos+MX9aq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196987, "uuid": "15a3722f-c063-4765-91b1-b6844507d462", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196987, "uuid": "60fe2a32-e887-48ea-92da-8561bc6a8da0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196987, "uuid": "c3f5713e-1c3b-467f-9d8e-b7f0bb70c2ae", "value": "SLEE-0809\u7c3d\u540d\u6587\u4ef6.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d17f5b0-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680158714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158714, "uuid": "89806448-529d-4120-a8c1-c0ce4e4a7633", "comment": "Malware payload (Amadey)", "value": "6a4c2f2b6e1bbce94b4d00e91e690d0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158714, "uuid": "181abcc3-1178-4a3d-b94c-0dff0754657e", "comment": "Malware payload (Amadey)", "value": "8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158714, "uuid": "65a29604-e5fc-4957-8420-981fee25d11e", "comment": "Malware payload (Amadey)", "value": "f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158714, "uuid": "fcfa44e0-cacf-40a1-9a6c-8fa35ab2af22", "comment": "Malware payload (Amadey)", "value": "c7301b3034f44082a30ea8303f86afa4dde58cc2ab3773cae321fc75cc55e051d508f0cb51ba4e271f34caf77b87e1de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158714, "uuid": "45e88124-6624-4dec-8564-f6e59bd26b87", "value": "T14D936B1030D2C471D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158714, "uuid": "55cd0f97-23f7-4189-ba8a-f18ae56fd83b", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158714, "uuid": "372df904-79f8-4b6c-ac2d-590f8630b315", "value": "1536:xo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUjOaB89p:xoUCWbBNpplToUs1uNhj25LJUiaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158714, "uuid": "06b62ba1-10bf-4ef3-bd5b-93193efdf9ca", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158714, "uuid": "00e0aac1-82c1-4d4f-905e-e808e758d5a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158714, "uuid": "aeafa7cb-a5c4-44f7-b2a9-702128b4f7be", "value": "6a4c2f2b6e1bbce94b4d00e91e690d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5bea8c-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680170982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170982, "uuid": "706b0d6f-81d9-493f-9683-3e6e8557eb40", "comment": "Malware payload", "value": "b1ea066ddf698439916c5a009ea16ee6", "object_relation": "md5", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170982, "uuid": "c689a0f4-ba1e-4383-97fb-325e9a082f74", "comment": "Malware payload", "value": "8c30e0e3546829c7c7007b2720151342b945a6593be960cd060cee17829c95cd", "object_relation": "sha256", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170982, "uuid": "88cdaf12-0fdc-49e6-b99f-3eb7d385dee0", "comment": "Malware payload", "value": "07def9e0a689160c5d0ed823c1a58bcd99fed989", "object_relation": "sha1", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170982, "uuid": "9520ed12-4215-4e29-9581-6e285d73d5cd", "comment": "Malware payload", "value": "cd8d73c928eef70a65f3cf8f95406b3a396f514548e758ea7da8f8a14bc812716a2657948d468d490257b29eb0517c1e", "object_relation": "sha3-384", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170982, "uuid": "d6c83a60-aa52-4fb4-b4d9-b395e00cc52d", "value": "T1E4837324B9E6090912CF7F6B052D9470D56C89338ED8E657B83EB117EFCE44CC4A4AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170982, "uuid": "d053be81-d9f6-4a37-b723-839c1c11011a", "value": "768:KwSh7b1QTDETN2tOrJQoX1CeFmlup86qT2ZGJdUG/v6zbkqZtgIotiz5VsY65Td2:Bu311B2IrJQw1CeFmHROZBdypZSveMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170982, "uuid": "50c4ec57-9f81-4ec7-8632-798caf3c3a3d", "value": 86313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170982, "uuid": "1b5afbc0-e329-453a-92e7-5083e3f8d79a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170982, "uuid": "245fd12b-f905-47ab-a721-faf50d00113c", "value": "eo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77f4fee-ce93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680136988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136988, "uuid": "1ef30c9a-2957-4e4b-84a3-297c59d86448", "comment": "Malware payload (Smoke Loader)", "value": "96322d036053bd0051b849a924431e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136988, "uuid": "2dac26d3-4090-4e2d-a734-f2591c2a4022", "comment": "Malware payload (Smoke Loader)", "value": "8c3e997297c13b34e055eb73bd58c9e05c8d91d07f986b2e2d35856567d1b5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136988, "uuid": "faf440b8-3033-4d19-a288-840ed8673794", "comment": "Malware payload (Smoke Loader)", "value": "e8c5f53cd9f6294634a3dff40447d9d8156619f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136988, "uuid": "4581f64b-ac29-4b82-98e7-4327f4d32bfb", "comment": "Malware payload (Smoke Loader)", "value": "34d3a8138e89052074e951c6ca0a17ac41f2bcad1983d37bc053fb7f0d30b3b538244b9d42a2ab91a2414de3ecdce701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136988, "uuid": "179cc957-7d6a-417e-9712-37d23ce75dfb", "value": "T1EE44D0127B92C4B2E51B09BD5911CBB85E7BB8718B22CBC7279017BE5E307D28B35346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136988, "uuid": "e7ad3e2c-e4d7-44a7-ad19-eeb5faa48299", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136988, "uuid": "aba798b2-e247-4a4d-951c-4e2016762598", "value": "3072:QQj8tkZJ8XPLD2+Leo0VgBHMy8GdQ5RBTJxvLdTV+58h+f4tCU6C2aRJd4pVFu8:d8GAPLDxLeoN1zeRBT9E5yC43M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136988, "uuid": "5dbd3dc9-9691-4acc-b425-a22b37d4b736", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136988, "uuid": "033add9b-8e08-42bd-9aec-429d95a89e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136988, "uuid": "56d9f3d3-9557-43c0-92bf-8b83d9746f93", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81931517-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196974, "uuid": "24737030-fb46-4046-91b6-6eae66c80478", "comment": "Malware payload (SnakeKeylogger)", "value": "1d885d248d97db197cbf33f0378d552e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196974, "uuid": "47883c8b-9017-40d1-812b-00257bcf6609", "comment": "Malware payload (SnakeKeylogger)", "value": "8c5196ab71948b50f40dec9109a01ace94593cc5d606588814b21cbfdcce5c17", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196974, "uuid": "20514ef5-243f-42d3-89d7-0d6b26e5d38e", "comment": "Malware payload (SnakeKeylogger)", "value": "382bf7ab69aa792cb9c9be30dc2e1b57f5b46a7f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196974, "uuid": "6e52e6ea-71db-4cf9-9727-cf8117cbb4e5", "comment": "Malware payload (SnakeKeylogger)", "value": "97f883d3b29a326cebee6fbc2dbf95043a9fa5cb75ed0867e90273970e4ae4762e79b4fdc1ce800d35694c9fc66f779c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196974, "uuid": "6309e4c6-1d89-4f1a-ae2f-381bc40dfad9", "value": "T11DD21A5AE79E02788F9102B3671A1AC9A6BDB63EB3515461346C433433EDC3E42766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196974, "uuid": "38396617-334a-4324-ba65-3ae0ffb4bd6b", "value": "768:n0Fx0XaIsnPRIa4fwJM8/2avjzl1kKIWjUfXA9ww2eTEK7:0f0Xvx3EMm2abzl1kFWoA9ww2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196974, "uuid": "8d76a485-e274-4291-9608-59337dedd482", "value": 30224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196974, "uuid": "89e15a19-2c42-44ca-8046-2b8c6c74c250", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196974, "uuid": "d0a9fa09-3982-4d32-83c5-b5eb773793cd", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4d7fc7-cebf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680155653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155653, "uuid": "61b85d9d-a0d5-423f-9bf7-ab8b2e649435", "comment": "Malware payload", "value": "9e232a14ba4fdb7f95d59d06682af25f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155653, "uuid": "e89ebefb-56f9-434e-8580-6025815bb7ef", "comment": "Malware payload", "value": "8d855c28744dd6a9c0668ad9659baf06e5e448353f54d2f99beddd21b41390b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155653, "uuid": "1370dac7-bf53-41c3-94dc-5aad5eb4d6b6", "comment": "Malware payload", "value": "f49dba7152bde55c4bb014a1819b466a35473915", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155653, "uuid": "07b58c8f-2209-4c5f-a818-b674fb0d5ef4", "comment": "Malware payload", "value": "1400fbeb6dd590150096750e8e8ab7ec699204ba1423c6bc6fe7eaf24c6e281e3d1735aa7cc7533e253b996209170889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155653, "uuid": "06e17aca-e912-4416-8c8c-e32bf96de259", "value": "T1D4E57C27B8A214FDC59BD030975F8172AD74B8E843217E7B2395DA303E26EA01F1EB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155653, "uuid": "a1f20be8-fa87-4579-a1f5-d0fb87a60e3f", "value": "98304:t2k8YNW6FUZu0W0E8oGYGCZ15nL3r+prEWp5a0OI:EZGZ8oru5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680155653, "uuid": "ea6f3979-fef2-48ea-92a0-5f9ff1a407ad", "value": 3162536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680155653, "uuid": "fee73fbb-bc75-405c-a850-3e16f8cc9d63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155653, "uuid": "e2f8c3c4-dec8-487d-becd-d0718c823000", "value": "8d855c28744dd6a9c0668ad9659baf06e5e448353f54d2f99beddd21b41390b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca10c9b-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680159116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159116, "uuid": "aad10db1-313e-448c-a658-7fb3cfa75ce9", "comment": "Malware payload (GuLoader)", "value": "86f5da1a5a394d5324e40a74afafe314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159116, "uuid": "596e773f-9702-4afe-b1cb-2571f9133b33", "comment": "Malware payload (GuLoader)", "value": "8e2592445728a1950fab0e7367efa48a84863658d968a090d0cf9e080b42d11b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159116, "uuid": "38b87253-6d1c-4ced-98fd-47930b83d12c", "comment": "Malware payload (GuLoader)", "value": "39eb56a1dc17af35412c424159e612b3f9136597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159116, "uuid": "d26aca4b-97a0-4e79-8d47-f2271308b792", "comment": "Malware payload (GuLoader)", "value": "3d2520aa930bd4715d070fed1985ccd18c5e2bca34d73cfce36887058235c1cfef716eb88a97a894bb1157e2fb22852e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159116, "uuid": "7ba95cff-6405-45bf-a39d-199a32619b1f", "value": "T1A674F19393E0DF07E0398B353924C2B297EE6D0935325DE35660259DEEB2293DF4760A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159116, "uuid": "fa1ba8e0-7d73-412b-a753-9f5e2f31d54f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159116, "uuid": "f79b2510-6cf4-4a81-9863-8cba6dacb718", "value": "6144:oT4DtKy/qOe6ZakSELcE9z9ECzrK2XyNHRdqNPC9Pd9ZepXYyeF:oTDy/1e6Z11gE9zcNuAPbcpX2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159116, "uuid": "4b4a8a96-adaa-43c5-8af6-9276f78d96bf", "value": 351173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159116, "uuid": "136f49be-3d03-4edc-8c57-86f3e0c4e2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159116, "uuid": "387531b6-60a8-4ba6-8075-0336d0fae99e", "value": "E5131385 - Eiserlo & Emmrich GmbH New Order.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f59bfd0-cedf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680169455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169455, "uuid": "dad67e91-9ec9-4017-ad3c-4a01a2cced16", "comment": "Malware payload", "value": "2d91ffef67e175b985a7aff442da3b18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169455, "uuid": "89165955-e0a5-4541-97c8-1877b39d3d30", "comment": "Malware payload", "value": "8e460d699647bf5f9f2fccdc59fd711b401367fd2007c2df3831613233dc27e1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169455, "uuid": "1931712c-094d-43aa-992a-7be501f13e6c", "comment": "Malware payload", "value": "beb4e42c6cab1faf962b9d6602d9486fcf0c40c8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169455, "uuid": "b0b8ff60-e6d7-40b9-b08b-0eec91eea6be", "comment": "Malware payload", "value": "4df046aa4b03f8afb3d1e05f391ee93df6f99f42800f04e7f411cf82f9e91c2b7b8ae6e19d71bbc9450b3d05286d7d76", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169455, "uuid": "6acd7b9c-0189-4b99-a7b3-9752ae2ea9ad", "value": "T1DB52AEBAF540B919D355C5BDE44902F0F61ED0C34208E4DF6012738B4B626879ACFADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169455, "uuid": "f4e50309-0db0-4f55-acc1-e7b8d9461163", "value": "384:TDCXYyhkzYuatC5/FG6F7//opfMAi5Lg0:TtyhkzGtiYEA0L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169455, "uuid": "0da2a530-c64c-499b-a850-fc1de613ae86", "value": 13770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169455, "uuid": "4bded530-8a44-488d-b475-07fd20dfd675", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169455, "uuid": "613f45cc-ead4-4b19-8971-a66180d37275", "value": "Donation Fund.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a12ba55-cedb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680167594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167594, "uuid": "0a7eac69-616f-4ce5-8b30-3cc60dd22f22", "comment": "Malware payload (AgentTesla)", "value": "200783f388b7bfab096d19bf592d9fcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167594, "uuid": "6360688b-4ad0-4e5d-b288-7e767bc6cffa", "comment": "Malware payload (AgentTesla)", "value": "8e6f3d1c4d4bbd3e154e14d6729e75994dbd9961eebd7adccacc3ab25dcecb64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167594, "uuid": "cad5730f-110b-4c28-b4cd-0818dadc95be", "comment": "Malware payload (AgentTesla)", "value": "8e573db0c0308c41d2054b72b34063b71125d469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167594, "uuid": "110c1e84-e98c-4735-9bd2-856891fc6846", "comment": "Malware payload (AgentTesla)", "value": "f06b08e3baff91e98e63d69913db45eba998c4079d730dd7cc7666ae6db4faaeec77f2583a40b68ebad470e40e4a557f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167594, "uuid": "f06003f8-8115-4974-ab72-d8feff156129", "value": "T113B5F1733B509F94DEBD07B153929060A3A6AC6AE911D30C6FC411DE2FE5BC11E25B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167594, "uuid": "f61c122c-55ef-4967-aa0a-fb8e2e1a9a5e", "value": "24576:hFJvj8ZE/OK1yhYcp/2111VD+7AB7L+KgyrrrrPrF0BMnlE6AE6nnjqKoe:h/qE/OEGh4ykODyFBnK6ejqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167594, "uuid": "642ca034-bafb-4dc3-8276-6866e771d962", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167594, "uuid": "f4ab19d3-463d-446f-820b-abb12e551d7b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167594, "uuid": "65d0b919-5d0f-4246-8a4d-34b26e54ee28", "value": "QUOTATION#231984.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0821cc1-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680198395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198395, "uuid": "231813ae-9066-4faf-ae91-370d601823a8", "comment": "Malware payload (Formbook)", "value": "afb97c202e04ccfe4f66a82303718321", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198395, "uuid": "c9ceb462-5644-4dc4-8027-180701f4dab6", "comment": "Malware payload (Formbook)", "value": "90144e9ed70c41764f7db4608bad61d08ec7d62f6e105fe862886cd44216d3d8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198395, "uuid": "f9eb75a7-4ac2-481b-9018-dc36e74a81e5", "comment": "Malware payload (Formbook)", "value": "ffa2333b7d0faa85d48bd9a663aca9b39ad5b961", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198395, "uuid": "f7a3c2ee-059c-4275-9e05-164efd0cce0f", "comment": "Malware payload (Formbook)", "value": "a1e9144518ca9277940c1ae9bb348e1779d5612e4aeaf03132f77658070183fc0f57eaee5c5ca3491b72bd3bd6effde1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198395, "uuid": "ecb174b9-2fde-4291-b080-03fa56cdee59", "value": "T10A5413A432C0D8A7CD6742314D7377A3BABAE52964AD5B2F03A04F5D3D21232D42E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198395, "uuid": "76e2453a-ad8c-489d-afdc-54d7788a810a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198395, "uuid": "d45c6593-6ae9-4923-a089-2d302626d78b", "value": "6144:/Ya60pXcYkNpbDPOmHA7OMRTHnDHJ5KIyu6lIIjh72wWa8EzXiUgBg+NmtlvS:/YqpgNpbDPoOapZ16OadWIzXflxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198395, "uuid": "ba4aa5c2-edc6-45b1-9e49-6c354f3937ad", "value": 304788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198395, "uuid": "4e04f046-908c-4180-9599-85ebc5a019e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198395, "uuid": "bd507207-e460-4ae8-bef1-6f2bc95c1998", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1940d61-ced3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680164413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164413, "uuid": "2a7847de-af52-4424-b64e-7ab5b3927ece", "comment": "Malware payload (Loki)", "value": "8c3604965e74072c5439307e0494192d", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164413, "uuid": "5cfcf595-5414-4afe-816b-0b0abfce8160", "comment": "Malware payload (Loki)", "value": "907bedcdb5f837bf5c3383aa22804f75f0ed0a08f499197dd9b2f92e6a9247e4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164413, "uuid": "8436bdfd-12ff-4df7-9a22-8f9064774342", "comment": "Malware payload (Loki)", "value": "b6378d53b5167b45702628883bb7368f970c5080", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164413, "uuid": "b76c7e7e-6e76-454a-a5bc-3a19ee8253c2", "comment": "Malware payload (Loki)", "value": "55d151fdda0d7afa8fa84be5ba7536d074e40ce6c737964f4442964545142a335751596219312bca5f37c820fefcb906", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164413, "uuid": "c2df9a0a-319e-4f9d-a978-d329dd8219b9", "value": "T1EA54238B51004B49E3B5DB34E310A5A2C2C75FD75CF527E6739C04A9AF57480EAE27E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164413, "uuid": "1e65bf05-6fa0-4dfd-9eae-34be8d0cd01c", "value": "6144:BCCDDkxavrq0KbsBf+IxRhBiX7rXjqi6RAzqw:YCDAxaTibs9+kRhYx6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680164413, "uuid": "e8073d2e-90e1-4eae-ab41-a31dfae6b490", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680164413, "uuid": "22480e9f-117b-4a95-8265-271b0499fc04", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164413, "uuid": "bacc8138-e065-4d29-ae27-461eff12af17", "value": "Siparis_listesi_P.O._nr_30596130.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014560ec-ceda-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680167123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167123, "uuid": "233f1158-fb6e-4cdd-a963-04478d62d7f4", "comment": "Malware payload (RedLineStealer)", "value": "94e7ab1ad3fd884e93a28e99f37c3f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167123, "uuid": "ad5c6a1c-67ed-4101-850d-4ebba14047af", "comment": "Malware payload (RedLineStealer)", "value": "90e22d00909d1a2ba47f124879ccabd25ad6c3bd48298c2a387e82234339b5c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167123, "uuid": "ac320a61-0d9f-434b-bbae-f7c357b0b5c2", "comment": "Malware payload (RedLineStealer)", "value": "96e6ebbd87767a94283f2fb8fd7e985f989643ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167123, "uuid": "80edd3dd-f8dc-4190-bdeb-12a37a723a66", "comment": "Malware payload (RedLineStealer)", "value": "201e0291cdb7ff7b1772fcaf4c3c990a1490d81cb9241f5c4e51231340d654a79d625724e83670a604086854c60d4dd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167123, "uuid": "e2920a1c-36e8-423d-9964-ee2749b02536", "value": "T169252312E7C844B3E5F033B048F2178B2B3674F699B8866A1645B14F8C769E19C3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167123, "uuid": "74642aff-7b89-45da-950b-f4916d38cda6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167123, "uuid": "f4b973a3-747c-4ac9-9c38-2a11f2d2dbc5", "value": "24576:3yhgIJ5dx8J3DcL3L8mpas3l3idNTFQxpYMvvTWlf1B:Cmk5TOkDaEybRWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167123, "uuid": "662dacb3-979e-4836-8c76-fcbb8abd17c0", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167123, "uuid": "73f98001-3f35-49c4-beca-92896519e322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167123, "uuid": "263b416c-7fde-4e57-a31c-76771ec9967f", "value": "90e22d00909d1a2ba47f124879ccabd25ad6c3bd48298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b600c82-cf0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680188293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188293, "uuid": "c41c50b0-7155-4045-bd80-06e5f8bf881f", "comment": "Malware payload (AgentTesla)", "value": "a4879566be2b120a467aa8eab04f7791", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188293, "uuid": "0b1bf89b-68a4-4001-b450-6763572717db", "comment": "Malware payload (AgentTesla)", "value": "9155f988f900b1da8d1ce3a88febfe96485f78b511fed5be27fb5e73c5dfe491", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188293, "uuid": "a481c63c-a8cb-44b3-bb57-03a49e9901b4", "comment": "Malware payload (AgentTesla)", "value": "14335d6b8672cc389b942c9aee27151dd4987a8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188293, "uuid": "a9206605-0969-4055-aa99-65be29c46392", "comment": "Malware payload (AgentTesla)", "value": "d9c98092ba4fd48be41e456d9022f49476aadd3542b59a69dc991a8398d2b74b97320e3cb8965c583858d1580a236612", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188293, "uuid": "8dc16675-2c9a-458c-a822-1159221bdf2c", "value": "T159152361469024A99E4E1FB529E7A7FA6B9F310E64172F032FDCFFD60428875D3A024D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188293, "uuid": "4088b6b3-7f28-405b-91a6-46c326eea5af", "value": "24576:Hm39HDzTaW07ysjPuPD4siejhUUDWBZLhEU3cXBX2FtpvAvbr51CWF:GpnajysS74sieF7GZLhEU6gFPIvvLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188293, "uuid": "453932e5-da51-44f1-bcdc-2f7af8b9eaec", "value": 959648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188293, "uuid": "de743963-755e-471f-9884-ec417abd642d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188293, "uuid": "f1052053-f372-4118-9bcf-10000a1b794f", "value": "New Catalog and Prices.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0ad834-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196830, "uuid": "75503b83-b055-44b8-8ca9-0e96391743a3", "comment": "Malware payload (SnakeKeylogger)", "value": "f669a917dab14fbc889d0854e1a11222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196830, "uuid": "de05b596-f89f-4922-8ad1-ba091d6f93aa", "comment": "Malware payload (SnakeKeylogger)", "value": "91a0d70bd86208f09ad80df3816949c4b8efd73dde1a0bc885102284f59dda24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196830, "uuid": "0a2d7ff9-4ae0-4f76-8077-b4c4d2b9103b", "comment": "Malware payload (SnakeKeylogger)", "value": "84579856276c90c935173bbc572a87beac6f4629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196830, "uuid": "6fde9e39-38be-4d77-9816-50f46025deae", "comment": "Malware payload (SnakeKeylogger)", "value": "1613a86aab2471f77f27aa041130bcec7538c8b2fe16bc284712c1767046df5121fd0e3137d61780109bf2275f798087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196830, "uuid": "c8ac8433-8c18-4b33-812d-79063b660852", "value": "T18A156DD1F190C89AE86B45F1AD6AE53025E7AE9C94A4810C56DDBF1736F3342309FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196830, "uuid": "e7180d08-a523-4949-9b38-d2e9e2c35951", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196830, "uuid": "1b60bca8-13e5-42e5-a5d2-df220191858f", "value": "12288:NNNeayNt15fZHRQxHS3ift0HZ1gdhNq3OfbJiimOMt+:NNNeayNlfZxQ8VM8sUimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196830, "uuid": "c98f24a8-21a9-47d0-a4ba-f18b992776ee", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196830, "uuid": "f681e820-450e-4452-a70c-665d455ecdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196830, "uuid": "757fd02a-3ccf-4633-be10-a82de88cbcbe", "value": "\u0130\u015eLEM - Kredi Kart\u0131 Hesap \u00d6zeti - 45431108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf377b5-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680198307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198307, "uuid": "4c6543ff-215b-457c-aa3f-68a221eeac25", "comment": "Malware payload (Formbook)", "value": "d9f11abb5fbd7478a8fe993cfe8aac52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198307, "uuid": "b3d2b065-bb82-43e9-a7a9-4615a21290da", "comment": "Malware payload (Formbook)", "value": "91d502f918a232073359481d07dc7ba2d21b7675bcdc3e3cd0440f1cc9557833", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198307, "uuid": "4bb692b9-5cea-41c3-a7bb-045ea644446f", "comment": "Malware payload (Formbook)", "value": "4ef674f52ba7fb3d8f6ba2ddd2466b5da24b9b20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198307, "uuid": "132e52a5-7717-4192-9798-f18ef8ed03b8", "comment": "Malware payload (Formbook)", "value": "0e36819f33859e0c7e448236b54f7b0f34858ab3f7210f7fb9d3e886f76dba1c86e6cc6d489134b7b33992a2b05f6c00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198307, "uuid": "a239744a-6e48-4be0-895f-15fbae6e6e45", "value": "T136F49D7C1BEC8656E039D7758BF04C20E7EDB4177636CE1E79EA00860A67A42758336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198307, "uuid": "3dd6011e-dddd-44d1-b877-7f395547a9aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198307, "uuid": "1e23ecce-f4d7-4cdf-bff1-49a2f204ee4b", "value": "12288:NQxxBLyywVex3ozH9eqFYLIIm3JkKNzXsle5Cocz6:NknwVegHsqFIliBzXs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198307, "uuid": "68a47875-b3a7-4359-ac1a-2fd6e254d174", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198307, "uuid": "cf68c8aa-4f1e-4568-ba0e-d78ac562880d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198307, "uuid": "a36bb415-6893-4f9c-b66e-a47700a4d140", "value": "d9f11abb5fbd7478a8fe993cfe8aac52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d935a90-ce91-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680135898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135898, "uuid": "f1b2d8f5-a8bc-4c0e-8094-18395c694500", "comment": "Malware payload", "value": "3703770e32820397c6e7e1e1221e6d0d", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135898, "uuid": "464786a3-499b-430c-bf5f-28985ccccf49", "comment": "Malware payload", "value": "92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135898, "uuid": "991eb2b4-f4d9-4465-b803-1a0bf53f3549", "comment": "Malware payload", "value": "5d833bcc679db38a45111269e727ec58b75c8d31", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135898, "uuid": "1f98c257-23e3-4889-82e7-6b95b2bd085c", "comment": "Malware payload", "value": "9577fc262677b5825514743adf497a74ce20cbf7ccc2b69547740dcf484626fdb6de641739b4058251794c0b56f0bdb1", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680135898, "uuid": "9bb5034f-e2a4-4b8c-822e-578768a0b232", "value": "T178D33B9B1B882421FD48997412CEB7A3EF73F2981FA2002B3152C4D52F53BB57A1D56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680135898, "uuid": "4a086250-c02b-44fd-a216-827311715b5f", "value": "384:Zmi+xrnmoVLvmr+Q8Cr9rtOFrhn4rNab8erL5iK6FVEUnXr+Q8CrNrPSrhn4rNa3:wi+xds8SOXqab8EiAO8ygqab8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680135898, "uuid": "ff724d81-18a9-43e7-87e0-6a85c4618ef0", "value": 135792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680135898, "uuid": "d7eef98c-0c61-4981-b0be-6c0084a41227", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680135898, "uuid": "fe8c1777-4207-4685-bfbe-b95fb9a52faa", "value": "92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515ed55d-ce93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680136763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136763, "uuid": "41686073-c5c6-409e-aa3a-c3813ae61a7d", "comment": "Malware payload (Smoke Loader)", "value": "cf2855c9cbc2ea22ccbd224d1aff2748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136763, "uuid": "517ff997-830d-4592-99f2-db259c15d7d8", "comment": "Malware payload (Smoke Loader)", "value": "928a103929ab627d550d6153233349b9ca6984d8752fac96fc8ec5d17be19935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136763, "uuid": "9d5c6bde-4107-428a-94ec-ba9d61bd8792", "comment": "Malware payload (Smoke Loader)", "value": "d9aeefbc365f889920b9e9c8f3641b2b1f56d149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136763, "uuid": "9d283a9a-f644-4fa3-ba1a-ffb9f937fe56", "comment": "Malware payload (Smoke Loader)", "value": "5ceb29e2cd9cf1c54e56863233eac82bf168eb06fd4f46adfa2357041bfb8f3824b0636726f543f8a4ef9c20f16fcf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136763, "uuid": "e92cc07a-3631-40e5-b2dd-088c1427367e", "value": "T1AE44D01277A1C872E95B05B94852CBB45F3FB8718B258ACB27941B6E4F307D28F36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136763, "uuid": "44301428-e88e-49f7-bc6b-b276183e4365", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136763, "uuid": "51c2a6cb-1eaa-4fe9-b30d-5d142c840d1a", "value": "3072:LO6zt/pJ8XzDZ5FLeyYxgFFi5CrGS7y7arbh2zS9dj36cLmtQXT3Wd4pq:5zBwzDZ7Ley9u5sGS7y7kQzyuclXb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136763, "uuid": "b2a1f29f-c0c8-4ba0-af63-1a99564795c9", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136763, "uuid": "c4de6d69-7339-490f-9696-d537cf56f853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136763, "uuid": "025371ac-759a-48be-9159-ee7add25d2a2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4dd968-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219215, "uuid": "de535c46-33cf-4376-9d82-56b764b75eed", "comment": "Malware payload (ZLoader)", "value": "754c2720bc293a551469a1119707d3b4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219215, "uuid": "badb1e29-9196-4665-93e0-a626ccf5a672", "comment": "Malware payload (ZLoader)", "value": "934ebca653ff2a2f5b8d56536e90f90f353bb18c761cc5ca82fb72efe7cd4d93", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219215, "uuid": "b78330aa-3437-4cd7-a1e1-4c775dc827a7", "comment": "Malware payload (ZLoader)", "value": "355629dd7b1a25fc12264b530be5c456d30a9ef7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219215, "uuid": "1c57efb0-9302-4b9c-92b4-a2341d681cca", "comment": "Malware payload (ZLoader)", "value": "ee05f31687c08a2e0a094749755e899a53dd616e8c5426da32d567623bdf4e2e9b4b11eb6cbdea41c7fc7835be1cabc2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219215, "uuid": "4ab357a4-76ef-4d01-9745-05b730811911", "value": "T19AF284F3B7D5DD65CE4C437A486742A0A713EC5567AB838B3345F7262FB1BA04A02287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219215, "uuid": "40cec48e-b68e-4676-9f8e-b3df86a772f6", "value": "768:xPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJxIE8cBImXmtG:5ok3hbdlylKsgqopeJBWhZFGkE+cL2NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219215, "uuid": "09ba7683-c905-4cf3-ad2a-3068446337fa", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219215, "uuid": "612b260e-4cd1-4317-9ef1-1de2a26a160d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219215, "uuid": "f5b3928a-a69d-4aa4-b1c1-4b12e27afa72", "value": "SecuriteInfo.com.XF.AShadow.1205.5155.21550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305db0e2-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196838, "uuid": "06d432c5-f880-4a84-a33c-5dd023dcfcf9", "comment": "Malware payload (SnakeKeylogger)", "value": "3531cf533d859003c224747afadc8f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196838, "uuid": "8ac64463-7003-4778-adbf-407d5bd9f813", "comment": "Malware payload (SnakeKeylogger)", "value": "936e780eba4b7c04267fd9920295dcfce6e5cc6782e75dcd56041d4ea40de60f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196838, "uuid": "24b3cd06-39bb-4ea2-bec1-8ade93da4724", "comment": "Malware payload (SnakeKeylogger)", "value": "7d2af9d9e23f056769befb43a1d03f0d12179b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196838, "uuid": "e493b6f7-507d-4a3a-844b-c8feff51d4e3", "comment": "Malware payload (SnakeKeylogger)", "value": "74e55202384248332bcadf6e9e9a67869eb4f39c45e9a667ee9dbc89343708f5a47835855cad49bd525d2c64462d55b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196838, "uuid": "717fb891-4c77-47f6-8090-6132df2c0bfc", "value": "T1922512047AE8C10DC126937DA1E0D2B067B6DDC9E2A2C7675FC9BCD773CE749A520286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196838, "uuid": "a50a1bed-9c01-49e9-86eb-fcc2d293aa51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196838, "uuid": "22d9e700-0be1-4893-8b50-b3ed7f87ff8f", "value": "24576:WmkO8EYGCBso0c4cF5oHCOYmsmRv2Hriq1o25zimX:W5OXYGCGojF5ACOYsYHXo25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196838, "uuid": "c76f0303-4121-4500-a7e6-0cc57fd5f161", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196838, "uuid": "946b59d7-51a9-4f0a-9e24-1c263e9d2b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196838, "uuid": "89db4e60-e9c4-4e2c-b9d4-19ee5864477c", "value": "Signed po_000165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba7933f-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680180589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180589, "uuid": "f43e3bb9-1ee7-4e1a-bc35-bc794bd817aa", "comment": "Malware payload (GuLoader)", "value": "2d6850786866c2d901f00cf018e31c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180589, "uuid": "00ea2ddb-dae0-44f2-b064-848d730c8388", "comment": "Malware payload (GuLoader)", "value": "937c5c7f89f4bc94355b490bc015a240badc8e8f5c291a2dafc5300aaad3892b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180589, "uuid": "77bd4fc1-8e81-4cfe-9316-9f1e0837d646", "comment": "Malware payload (GuLoader)", "value": "864c4e41313731a86ab09ddd7954f02be7fe4447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180589, "uuid": "de0a59c7-a131-4664-b539-e144b7fc4066", "comment": "Malware payload (GuLoader)", "value": "983c2bf19af44ec69b1e7bed62567910b61f2a67fa93f3e071139b5d2707112ecead80e91844fbd76e2d1a253ebc0d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180589, "uuid": "54358d48-8bf7-4bc7-8414-9bf835438254", "value": "T1564522467F80C573C62216F189B3E3758376AEA51A62065B32E07F2FBD7620294136FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180589, "uuid": "0b5cb703-cf16-479e-88a0-81dce9e09b4a", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180589, "uuid": "0fa5b71a-7d1f-451e-9116-7786d7e5b2d8", "value": "24576:WO/lnSVs+otNj+LAd67jd6rueOCkzrZz/c7BFdxREAs2nhZQHjN/x6a:WunCytNqLI6Xd6ae7khuLd8WhZQHJ/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180589, "uuid": "876360ee-38b5-4d48-9163-831e42c9e880", "value": 1273896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180589, "uuid": "5ed6017e-6584-45c4-8892-79f340189c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180589, "uuid": "a245f4a3-b962-4a6f-84ed-f3a54e5bb075", "value": "Kaneshite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769a7b18-ce95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137685, "uuid": "51c81f3e-28de-42dc-acd9-d9d372fa4e41", "comment": "Malware payload (Smoke Loader)", "value": "64db1020042ef00871bc85535b1c94db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137685, "uuid": "e8e0d560-5c7c-4f8f-a3f3-c5c1fa5fdccf", "comment": "Malware payload (Smoke Loader)", "value": "93b702e01161fe01b735504ae6f1cad6b45e70910743197204b2d868c5720c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137685, "uuid": "fd449fe3-9254-43af-a2d5-29d905d3caa7", "comment": "Malware payload (Smoke Loader)", "value": "f79480fa7e697fcbc2369f22104ea1c61fde7213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137685, "uuid": "b2596ddd-ddbd-4fd0-a6f1-0e7a3d379891", "comment": "Malware payload (Smoke Loader)", "value": "2322704e441a1fc6592aa268b06ece2c420748a101d95e27d5aab6e098ca7f79c80680d8c63c746589ac36cdbc557e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137685, "uuid": "1c4da76f-e771-402c-9cfc-2a373726e916", "value": "T1DA34D0223B92C473DA1A08794811CAB45A7FBCB15B258AC76B9057BD0F317F2DB36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137685, "uuid": "85f2132d-3a9b-4304-8979-bf043ef3b12f", "value": "248089891092684f7229c494995977e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137685, "uuid": "33dadf8a-bd01-4b0d-b4e2-17b3a91a2050", "value": "3072:UuI80kg8jLMRL4EteF3ZH1Z1AqGil0dE8gFY+ual05f/qL9/:Y8KiLMdQF3JaqGilGEZOao/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137685, "uuid": "8b2e103f-2de8-413f-acf2-4344828ba06b", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137685, "uuid": "83d62b38-e087-4f85-b0f1-b0a47e76f281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137685, "uuid": "cbd2a669-7418-4bf2-b379-9987a8472883", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170cc09f-ce99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680139243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139243, "uuid": "32825d1d-a2d3-447c-8f96-76076cb5a491", "comment": "Malware payload (Stop)", "value": "9af9b8e0b183de1a9eba096172a479ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139243, "uuid": "0270e6be-7475-4c9c-abf5-08b15ffd12be", "comment": "Malware payload (Stop)", "value": "93bdde6b091f62d424324f740b373fff288c577e8224c2de5357dbd464b17763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139243, "uuid": "c53a8ede-0a0e-45ff-b2cb-9311a8685c73", "comment": "Malware payload (Stop)", "value": "7f28200112ffe29f47362d9e745286f9eb4e6f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680139243, "uuid": "583f2e4c-c7c9-430a-9e9c-21a5eadcf6ea", "comment": "Malware payload (Stop)", "value": "b06573430572508f7ecc523684b07d6fb958bd8fec90fc586fecf1b0ee9f2e7dae70b6405cdc87bfb1fe7853bb5f0a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139243, "uuid": "a1e94977-43bb-4d09-9974-7bf430926e92", "value": "T12CF412227A92C433E15A44B18952DB749D7BBC790F668ECB23C407BA1E713D28F7474A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139243, "uuid": "8fc52264-fc62-46fd-afec-ee1e468fbeec", "value": "382fb326b0589506daf25ca040a05448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139243, "uuid": "8ffbfa56-84f0-403e-b316-11f40706e79e", "value": "12288:Y2uwqeEfhj1pArXmqL2anYS9YS4G7DeOuMSxwVjxGH7vEBm36hOw21LstNIc:YteEf7pArXTL7nPIaeOuMS+ZoTjPwmsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680139243, "uuid": "6e8c864c-18d5-4016-b4c5-d9559fac6a34", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680139243, "uuid": "750a5a86-297c-4861-8aa1-759edf71dc2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680139243, "uuid": "e3b2152a-f482-4867-8c66-e128af305d80", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cc537b-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680160955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160955, "uuid": "2ff7d343-630f-4c7f-86e4-064b70f5716d", "comment": "Malware payload (AgentTesla)", "value": "2acd19884dc08535b643868f682b3c84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160955, "uuid": "809b5a25-45f5-4c8f-8e1a-21128bb2ab16", "comment": "Malware payload (AgentTesla)", "value": "93d4a1c73f73cfabff4180c6b5ce9991b3cb41783440f29dc5745961741eefe7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160955, "uuid": "a0d7b5fa-3c6f-41d4-8e76-6c5952010e03", "comment": "Malware payload (AgentTesla)", "value": "c3577aea750eae81c5ea828633cd523f28979b26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160955, "uuid": "69105464-8e57-4723-a9c2-a3f0ee5fcd33", "comment": "Malware payload (AgentTesla)", "value": "7e009510090b8d038f9dcb321d7b7811471b21cc819ce3e05bb6afd4c3abf60b0c8f1a23377f4c677de5b2e2fd30f0ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160955, "uuid": "9d7332c5-9583-483f-ac0f-39e7b458094c", "value": "T1EB257B8673B290B3E89F4164153855CD5E39B1473406E12B6F3BBBB0A2212BF7E6F146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160955, "uuid": "7549dd5e-240c-487e-89e0-83d122ac978f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160955, "uuid": "bcf76a63-d59c-4f50-a18b-a2c7615eb15b", "value": "24576:d4PpyeFskkfO+Ucf/eHAzoAgWdFMkLUvHW7kX3Lu4:ZpHwMegXnzLy27kru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160955, "uuid": "435094cb-b009-4c82-8bad-216d0ad06399", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160955, "uuid": "759fc126-78a0-48aa-aa33-9c0a70632d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160955, "uuid": "c080fccf-862b-426b-90dd-900532a22c63", "value": "stage5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78732a02-cedb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680167753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167753, "uuid": "ee6b9e2e-638e-4ec3-bbe0-c57ca589d393", "comment": "Malware payload (AsyncRAT)", "value": "88ad59b38bec8f8a831f2daf2b2626f6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167753, "uuid": "81af63bb-55df-4cd8-bbb1-2311f6ccff4f", "comment": "Malware payload (AsyncRAT)", "value": "94530ce58a289fbba223ab50512183f2dc1003ab227b144d6ec21c15cc427cce", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167753, "uuid": "829b830f-0d3c-4ff7-bf49-bfb24aaa5141", "comment": "Malware payload (AsyncRAT)", "value": "f78a88a726f00fa1f58de07148eacc45994e6d95", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167753, "uuid": "6c1ecc89-d56a-4755-91fc-d5b7318eaca3", "comment": "Malware payload (AsyncRAT)", "value": "a1115f23094bb0f7bc2956106d1b7e59c94deabd00dfd8bbba94aa17e0ede566e56b6f958565addbe0105ced0f351721", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167753, "uuid": "bd6aaa2c-03f3-4845-a8d7-292fede17983", "value": "T195D4F142F7D284B2E57329364939AB11787D7D711E34DA1EB3D87D69CA30181A231BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167753, "uuid": "f1ee83b7-079d-4c55-8738-0c5a0a325c0b", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167753, "uuid": "1ccf2c3f-10fc-4977-b075-4d3581335e34", "value": "12288:NcrNS33L10QdrXjCDn2YeNoDue/WXvGiGpjOfGT95V11Z4nZuNL2Qm3F9U6:wNA3R5drX2D2Ybue//Ii9N34nsh2QKQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167753, "uuid": "1cb0c598-e402-4a5d-b381-c4c70ec3238b", "value": 652867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167753, "uuid": "4ff562c5-8756-4daf-a48f-8c2b53777022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167753, "uuid": "9e30cab3-a2a5-4838-8572-d6c1d448ede4", "value": "Pago2132023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2bddb3-cf01-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680184058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184058, "uuid": "12d1adff-cd2a-485d-aefd-36026530930d", "comment": "Malware payload (Formbook)", "value": "a904868887655565a03ffb102af7d191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184058, "uuid": "32648c51-b23f-4e3d-a526-426dbceb93b7", "comment": "Malware payload (Formbook)", "value": "9518bbb8733188879069262811a90b041d800479edbb1b0be4a7526deb47bbed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184058, "uuid": "beff95f2-42cf-416c-bfa8-1856687074e1", "comment": "Malware payload (Formbook)", "value": "1e2ac063df757aef5e40d5dfb6d691081e5dd176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680184058, "uuid": "44d830f8-3bdb-4a32-b9c0-3a520f079bfd", "comment": "Malware payload (Formbook)", "value": "d6b9d616dd9ca27b3615ded897512d2b7a7143bbd54482a9c3895ea555434127e1a1821cb5a998602706ee9c9bf84449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184058, "uuid": "629545b2-1b3f-4d06-a41f-66f549351aae", "value": "T15BE4F1203AE98609D02A973E91E5D1B1A7B8DCC4D2B3C7274FD9BCC3739E356552A086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184058, "uuid": "e4d8e657-7bd8-4a67-b121-f9f151795969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184058, "uuid": "49870697-a2f7-41eb-b7a8-41248012cdfa", "value": "12288:c1Tw8vQlZPiPPw+gC4VsbtpJv29kl8s0uIAjZxJj8imOMt+:c11VPdglgv2mlTIA/d8imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680184058, "uuid": "f1bf6e2d-2c07-4df4-a9b8-24a93b17d1a8", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680184058, "uuid": "21a94f7e-2c1d-4f04-a11e-9cc2d3e5ce3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680184058, "uuid": "e0662524-fbc6-4c3d-be48-d2e7ce4b2c89", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b1cea9-cee9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680173623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173623, "uuid": "3ac604e4-9709-4f70-b41a-bdf328a9bd03", "comment": "Malware payload (AgentTesla)", "value": "5b207618d49abfd8b2d432706f8ebc2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173623, "uuid": "bd1be585-5c71-41b0-a40d-1b2e8ec60b6a", "comment": "Malware payload (AgentTesla)", "value": "9711294918a8cc2e424c2bd81b3c81b8f8d939e1c761588399c9fcde7a2d0ec3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173623, "uuid": "e34f7049-0d5d-43bc-b94a-0800866a3078", "comment": "Malware payload (AgentTesla)", "value": "90f74fd3d21a9f09aeb3116dbfc97cd49264686d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173623, "uuid": "b8a3db2a-14ec-4651-95e4-13e12fd4fa30", "comment": "Malware payload (AgentTesla)", "value": "957bd25bfd9776296cdeb97c617161ca3c47eae10c00c7efea10fe523231ba518cd01da70a28a245dd63279af388ce83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173623, "uuid": "674a5559-de86-4177-b03e-36722f71c7ad", "value": "T187C423E71E096B56CE5A0E44211E3CB57F4AF97916F2230E62BFD4742E23B52DC92213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173623, "uuid": "b88349d6-2352-4f6a-a606-2bc3cbea4d4a", "value": "12288:9/qM4kM4bFhqvxlknCIdkSkpD6a5Csr9YwaM8UaHEKrgEuJsz1rwrMYdFgymR:5lM4bFcknCIdk35CcYwanvr+JrJdFgyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680173623, "uuid": "5c717a66-41c1-44d4-a047-f4bf4ae958b3", "value": 556895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680173623, "uuid": "7c1216b7-cc1b-43f5-a249-395b3c85f11f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173623, "uuid": "900b79db-5f56-4a99-838c-3138a0ec2b75", "value": "5190672.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36da098-ced1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680163530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163530, "uuid": "402919c2-b343-43d8-adff-8c34ca074be7", "comment": "Malware payload (DCRat)", "value": "0a022d070a6aad92cf2c2bd42904450e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163530, "uuid": "a5f28d2c-df9c-4503-adce-c6928fbf7ae1", "comment": "Malware payload (DCRat)", "value": "97cd6974b24b7e82fc2ae0caf4ed7aef3228a16c625c5091a50098208fbc8c64", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163530, "uuid": "abfe7795-5556-446b-8c21-aa0f23b06439", "comment": "Malware payload (DCRat)", "value": "3b50c321894bc0979a237c97bbc9e15cc8fa0060", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163530, "uuid": "f8bb41b6-e75e-4a60-8d2d-989e5024cce8", "comment": "Malware payload (DCRat)", "value": "f79532b302809bc237b711a179498b1235cae259e8ccfde949815e5179abee76dbd46c452fc038d630e9181e016df6df", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163530, "uuid": "74bb7e6d-caae-491a-973a-e6f2a1937de0", "value": "T18F65ECDD726072DFC85BD452DEA82CA8EA5174BB931F4203902715EDEA4D89BDF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163530, "uuid": "247a4003-eb87-4a84-8e26-8953d97c7a63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163530, "uuid": "10f01053-315b-4cf9-b23e-9051713896f9", "value": "12288:CXqxzqntNfrYusEIXwRg1k6+OkJzbS4qUMEsgZN8NGfmurA4tD9j4oI6P+QSvTM9:EOqnzzYuVowK4OkJ/S4qUM7H14Bp+xG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163530, "uuid": "dd3dfb63-6f1d-4f73-8b61-abba5b0a257e", "value": 1423360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163530, "uuid": "9070dc98-bc6e-4e33-b899-aa2c3ca85219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163530, "uuid": "00422980-64ee-4dc6-adce-2dc177b36c97", "value": "0a022d070a6aad92cf2c2bd42904450e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb995f2-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dalexis)", "timestamp": 1680200913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200913, "uuid": "f8f8eccd-5480-4f51-be61-9658bcd577d5", "comment": "Malware payload (Dalexis)", "value": "70def87d180616406e010051ed773749", "object_relation": "md5", "Tag": [ { "name": "Dalexis", "colour": "#91F6A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200913, "uuid": "98e59cf3-1403-4d64-8b08-003fecf21ac9", "comment": "Malware payload (Dalexis)", "value": "980d2f2d658324bb85ae044de91feb23a276e4ad04850588531e2f916a1696a2", "object_relation": "sha256", "Tag": [ { "name": "Dalexis", "colour": "#91F6A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200913, "uuid": "e3ddc178-e4ac-407b-9815-0e322e498906", "comment": "Malware payload (Dalexis)", "value": "04a5d783100c634cf01b862a839e2c7fb6797ca0", "object_relation": "sha1", "Tag": [ { "name": "Dalexis", "colour": "#91F6A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200913, "uuid": "05ad0aa6-ad5a-46bc-b1ad-96e8928feb7f", "comment": "Malware payload (Dalexis)", "value": "1fed1fcd5654e0d590298068436fd36ffcdf9ab1cd2e2da983ecd646794ff0d778904e4056a6c4a45087dc9d5012bf2b", "object_relation": "sha3-384", "Tag": [ { "name": "Dalexis", "colour": "#91F6A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200913, "uuid": "61d837b9-41fa-4561-80d8-f164dedeec56", "value": "T1A364C002B7D28472E5331935593AAB11AA7CBC201E74DA5FB7D43D2EDA31180A636F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200913, "uuid": "83acd7fe-b5e5-4e3a-8dd4-43cf1b8ae8f9", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200913, "uuid": "c2a6b3ee-c930-4865-a60c-8df18a448c41", "value": "6144:nc0h522p3l04ZMSmIp3Uy28uhyrgWUar30Fnlqj1ZXu8H:Phxp3lZnT9bDffr3KnlSXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200913, "uuid": "3900ca23-54d6-4074-8bbc-6ea9cbb7b0d2", "value": 323651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200913, "uuid": "e9082f58-300c-4258-a728-10d634251880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200913, "uuid": "c9022e9c-27a5-48a1-8020-d26c6ee9f1f3", "value": "SecuriteInfo.com.Trojan.GenericKD.5378055.17829.22512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bd4b7f-ce96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137955, "uuid": "46309b09-1fdd-4b6f-a5ab-f08840d1d9dc", "comment": "Malware payload (Smoke Loader)", "value": "4588cb1e6b34273e7d941341bbbb2cc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137955, "uuid": "1195d7f1-4eca-42ac-93bc-46f38db617a8", "comment": "Malware payload (Smoke Loader)", "value": "98578b9a02ab1a4c7f98439fd8bc184c1705f0270183d735d61a5256d6322cf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137955, "uuid": "98ec0caa-fda6-4e4b-ba07-b988522fe718", "comment": "Malware payload (Smoke Loader)", "value": "f2d0a3e918ed37b2782b948e391760c234a6a98e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137955, "uuid": "3df2a61d-0841-4975-86ff-1dbf547d400a", "comment": "Malware payload (Smoke Loader)", "value": "d69980bb82ba2470e90d1d372e65496a97a3ceab217a1efdf88fb7382a09439b900bd6dc0a072db7e233e9748e205ffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137955, "uuid": "c8a5075f-4f69-4c90-91d4-6ee69a69e83b", "value": "T18D34C022B282CC72D95B04750815DAF8EB3B787047259ACB2F84367E4E317D2DB36396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137955, "uuid": "f9cf4918-8888-4852-88a8-5b101954cc08", "value": "248089891092684f7229c494995977e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137955, "uuid": "ac2186da-5d1f-4fcb-985b-bff3b5e31635", "value": "3072:+8T5NuayL4RrwEB52MuRuNhlhiZxrZmsieQ505fylP/:H5ryL41B5PmKqrZmbety", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137955, "uuid": "7286aea3-e2ce-4cc1-9657-d6a5ea2f1296", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137955, "uuid": "0f323639-0521-4452-9ed6-173cfbb9f093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137955, "uuid": "cfb8df02-0285-4864-8053-8b1088903be9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3298186c-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180520, "uuid": "df4a7e8c-c271-4e44-9442-1ae0d2b70151", "comment": "Malware payload (AgentTesla)", "value": "aa83f9290af2a46c782df50d1087c49e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180520, "uuid": "a685edb4-b517-404c-99ec-aee0fa99b8f8", "comment": "Malware payload (AgentTesla)", "value": "992bf64436ed14bc5f5fa8d6fcf95ba658aa2b4f3e0b3d88093787bcb3b63588", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180520, "uuid": "f91ab26c-267d-4a75-b3f5-e83668655742", "comment": "Malware payload (AgentTesla)", "value": "45f94ad07d9d0dbae0a80b7eb99b562b054bcfc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180520, "uuid": "b84a5dec-bed3-4421-b7e8-c157e12a9864", "comment": "Malware payload (AgentTesla)", "value": "131c8baa4a8a5924dd81062b377a7f6441e61daa5488d468779c9a3868e5b08d5e218ccd261c6bea63a79529f8b04838", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180520, "uuid": "9289d08a-0a93-45e1-97b2-d177ee0b5d58", "value": "T1C464F850A6D0A4A3CAFC5E7A6A1BDD300F257DF9A115D1A935E83C9F75FABB30100293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180520, "uuid": "faf493b9-4f94-4e6f-8790-17eaba31ccd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180520, "uuid": "e5013040-f21d-4fb1-99ab-ea9feebf4bfd", "value": "6144:0IEkbUCumDb6ZMMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMc:jEM52MMMMMMMMMMMuMMMMMMMMMMMMMMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180520, "uuid": "819b86a9-171b-4c38-89d4-171417af71ca", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180520, "uuid": "460f5b19-60d3-4697-8ab4-a23ee2ea3717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180520, "uuid": "f5724483-8590-4b84-8a04-0e5f7b8393c0", "value": "Effisma GmbH_Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69269c36-cf07-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680186625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186625, "uuid": "d09bd54e-197f-4c09-bfa6-182af1aa31be", "comment": "Malware payload (RedLineStealer)", "value": "d23a7c850c38a12c828ea922fe0e48d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186625, "uuid": "de1a2f64-97be-405c-9ca8-7dfb6c986434", "comment": "Malware payload (RedLineStealer)", "value": "9951b232b95b5d9b06a7b1e0e97d1c73eb7696e7c8ade8f1eb8f31cf29c80f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186625, "uuid": "3d494c16-6a8d-451b-a031-6340d94d0634", "comment": "Malware payload (RedLineStealer)", "value": "afb300c7bfe22c67175b24b62797a64ee349b330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186625, "uuid": "cc667a48-770d-4c55-b0f4-f0d0c20960a7", "comment": "Malware payload (RedLineStealer)", "value": "1453647d9da8440e13a261d527066aabed2fa4a96760c1b3cd9e3fea1e6c3ee852da7a30c2510433d31c1ae90d3b6a49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186625, "uuid": "292e2980-305b-4890-989e-64a3e33d0841", "value": "T13F252217BBD98476FA741BB44CF302930A36BDC25978677A2644EC6A4C727C8782532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186625, "uuid": "59095ec6-04c1-4bf1-b906-2e82570dc40b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186625, "uuid": "8f401c95-07d3-4952-afde-d571a53853ec", "value": "24576:7y6VkLPr8d9Jpyl+3XPFe2tiuUvkD1n+LVMilDZrvo7U/GC:u8Ywd9JpyY3XRpeVMiXo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680186625, "uuid": "fff54d12-897d-4512-811c-b7fdf5d4eee5", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680186625, "uuid": "5c55b6bf-bb4d-48b5-8fd0-e0bf7d29a10d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186625, "uuid": "237ff8b0-7705-444f-969b-c325c2f4ef24", "value": "9951b232b95b5d9b06a7b1e0e97d1c73eb7696e7c8ade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d49036-ceb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680150894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150894, "uuid": "9f086776-8388-4532-8c88-9d50d2881433", "comment": "Malware payload (Formbook)", "value": "92a24824d555bc8f4a947992d85027b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150894, "uuid": "e0c8c62f-9080-43db-aed0-1879d139ca70", "comment": "Malware payload (Formbook)", "value": "99c70511abddfe39ccaea3fd4cafb9bc382ebdf0bd8b9a9c8f18a178ef63e664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150894, "uuid": "9401f83c-a9e6-4222-9d94-0099d1bc2b88", "comment": "Malware payload (Formbook)", "value": "0421241590e85664079db052bf77b79f05a0b8e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680150894, "uuid": "8b9a1f3a-6fe6-4780-aec6-0fe3a213b5d5", "comment": "Malware payload (Formbook)", "value": "53b27e448cd49c0f2e9ac74dca6e4af868db5f53736a94a85371f2fbc4fccd5490e568ee420300f62e4375056490071f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150894, "uuid": "ab2779ca-acbf-4abb-889a-f636ad20a21b", "value": "T1D9441245AAF5C9B7DAEB56312B3B17797EE4AC225275C60F13101B0C78B27A1D60E332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150894, "uuid": "cff2e882-7c2d-4e4e-a494-75160195a07e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150894, "uuid": "bbefb8b0-988a-4221-8d2f-3036f944f06e", "value": "6144:/Ya6skJA1+YTMYeHfXSuyDk7GgF4WsgI3NfTOIfCx:/YSQA1+0MlfizAC+sH9fTOkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680150894, "uuid": "de6a250c-e336-475f-8362-145a9cafde2f", "value": 266359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680150894, "uuid": "63056219-1442-47a9-b914-4699959e36b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680150894, "uuid": "cedb2db6-5bef-4099-8fd3-8364843c1c63", "value": "92a24824d555bc8f4a947992d85027b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac9786c-ced9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680167086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167086, "uuid": "2138249d-c8ba-4b40-b83b-5a9a15beb1d0", "comment": "Malware payload (Formbook)", "value": "9382db91f2e5799a51da843a33e3e2fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167086, "uuid": "1f162414-eb4a-4b6d-a6e0-9d5921a68e86", "comment": "Malware payload (Formbook)", "value": "9a24f59f2af8bc6f278f8ad8d8e9664687deef8ac0a387ea576a9d1e84837fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167086, "uuid": "10f4b02d-59fd-4035-b4b5-a647db38ff2c", "comment": "Malware payload (Formbook)", "value": "d790d2370fb485d5f659bb2d859239d662e61d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167086, "uuid": "41a3c4ab-33f1-46bd-9ab2-b0eb4f570cb3", "comment": "Malware payload (Formbook)", "value": "f6576b569864b4c21e0ffbd3a3a6006adb9538a5029b480a14a5f262f9d7d8fc7abdb85188d532726cf6b5f3dff67f67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167086, "uuid": "c8b8a80a-48dc-40bc-a38a-42f3ba741543", "value": "T16E6413046790D1B7DDF327B34E729E99AEFA4A320020964B33906F7D77964419E0F786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167086, "uuid": "a64230c1-96a2-475c-bc4d-cc3b3742c55d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167086, "uuid": "c2827419-07d0-456b-be99-83fadcac800b", "value": "6144:hT5UzmFsm1KpmjQb1xD/cNbnchml4qh25ehklF8gQpZGIEZyxguj/3Xh:hT55FFUb1xTcNbzl4qhWmklFEoZMgubh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167086, "uuid": "299d8879-c86f-41a5-a327-634d3370754a", "value": 330402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167086, "uuid": "983f9473-f7dd-46b6-9ab1-c472e9fae938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167086, "uuid": "dd49a8d8-9eab-4e10-aaf9-2855e4d37552", "value": "ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fa0992-cece-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680162326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162326, "uuid": "20ad76ce-4620-429f-8375-04810958560f", "comment": "Malware payload (AgentTesla)", "value": "c88256fceef22c3ec52029e1b59d3f97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162326, "uuid": "84aa8ac4-756c-445c-bffe-59717a0725ac", "comment": "Malware payload (AgentTesla)", "value": "9a555c3dede19ff1788835ed1df301f2b4454ca9c33785ec10830e16e2ddeaed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162326, "uuid": "fb18622a-5af3-4d93-a9c6-98281c1a16ab", "comment": "Malware payload (AgentTesla)", "value": "00306bd4e7acd4d18900dd054708603051e05a2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162326, "uuid": "b10e5305-973c-411a-b182-c79e69a12427", "comment": "Malware payload (AgentTesla)", "value": "dc27d359ae6fa7091a29dfd7ebd187b75cc7613a3d593a8ebc103613ca444a1ee94ed8d772f564c81f1c7dbf7d11f705", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162326, "uuid": "f8cf4a14-a5cf-4e92-ac11-aa0ecd605f50", "value": "T1A7E423E981C6036FD797BC16514AF336A2DB9E5BB85116F3A03AE70913BF704C0864A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162326, "uuid": "0d22a526-2f53-4a4d-aa6a-d4b382c93e5a", "value": "12288:SjVkvCZovIVZFyuSSmrVJsdMdybdDfw4RFbi5uevnmbxDABPqpzdmPdrMhv7Z63:Ks2ZIzZS7vukxiQEVcvl63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162326, "uuid": "535c77ab-8184-4e3d-837f-800e83b320aa", "value": 717874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162326, "uuid": "2262f645-d050-4ea9-b9d7-d3085546f128", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162326, "uuid": "8c6e5885-091a-4e6d-80cc-439992e83214", "value": "RFQ 071.23 020.23.Docx.xxe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3ce14b-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680200911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200911, "uuid": "60d70bf1-65af-42f3-95dd-002ca4c11418", "comment": "Malware payload", "value": "eee655c5522267d63314a0b20162d619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200911, "uuid": "059af528-cfd3-4b0e-9d52-acc7010759ff", "comment": "Malware payload", "value": "9ce13cd2bd4539852a6b5a1cacd98c7d07e4fe5cb5423a74a5141b84511b4e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200911, "uuid": "e7e339f9-39ed-41a9-aefd-0d6ba248a405", "comment": "Malware payload", "value": "16e627d311622191a2fa95530f5d834d900dfd46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200911, "uuid": "8b835d0e-08a5-4274-af35-d2cb10742b7c", "comment": "Malware payload", "value": "41c50ecfda5428d9784ed82d5919e470df0e39ce4f641f1cf7c880cdf7b5183f8855858f57ae344ef5609ba1c1baa6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200911, "uuid": "c1ea12f4-a99e-4de2-844f-d0b94410b1df", "value": "T17135331F4F21DD78ED2A223F30E35A1DC487EB1568CA51C4D952926D84CEB06DF229FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200911, "uuid": "765531c7-693e-4fa8-8cf6-19cca1d4dfe7", "value": "e84ac50ab5f95183bf1576db498b2c93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200911, "uuid": "d96d9339-e6af-4fd1-973c-f746e1d9a4ba", "value": "24576:vYnL1ZzK99PCU6Cykpz6Lhd0JETPi+Ppm0pNuvOj8YDj3XQrY:8L1w9hC9/kodWEW+PGcLDjnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200911, "uuid": "d5882bc9-1d47-450f-aee3-b027849c70be", "value": 1095776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200911, "uuid": "e682317b-e699-4a60-b712-36cba6b8ab31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200911, "uuid": "05bc6e07-ad5c-477c-8772-4534f298670d", "value": "SecuriteInfo.com.Trojan.Autoruns.GenericKD.35555986.4626.1529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b384844-ce90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680135465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135465, "uuid": "7e672261-8fff-417f-b7a3-607619059fc0", "comment": "Malware payload (Formbook)", "value": "bf66fea26b04d3730d5e6cceda43a68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135465, "uuid": "7b520c68-91b5-4140-9a44-882871d1c3ef", "comment": "Malware payload (Formbook)", "value": "9d18c79c4b9ce4b3638a2b6d4d202c76cb29a7da274eeb4a67179466322851d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135465, "uuid": "b3b2a15c-fbcb-4746-9c43-3f49d880457f", "comment": "Malware payload (Formbook)", "value": "3fe425cecb52ac013c5fbb8059040895e93dd374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680135465, "uuid": "007285a4-f6a8-4320-9665-c70d6f022279", "comment": "Malware payload (Formbook)", "value": "3527e97f44c00d0756c488ec7d058c97cf0368532fe4a145b08f95fd59056f39a65cabad84cd3c864ed9bca3b1440213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680135465, "uuid": "ad31118a-e935-4b66-81fe-04957acedbd0", "value": "T1D7353944FB65309EF012887AA16B3C2ECD11A45A96DEFB1F000FEF75E9DD10A9E41972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680135465, "uuid": "2f947386-964f-40b9-8d2a-4663f1abadb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680135465, "uuid": "11016693-041b-4567-9d61-558761d57a4c", "value": "12288:eJRWoG/lwf7UtcVAGhjuH7ZebMioQIid3Q6QqNv1Si5vTpF1+wGJieORSKsN0a1R:VpFiuH7BuIyQqNvVPkV5KstIgDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680135465, "uuid": "83b56fe5-b031-4ccb-943e-10be7e4009d6", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680135465, "uuid": "a7968879-292f-4d5d-9edd-a9fb00ce7c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680135465, "uuid": "06e31942-d624-40f6-90d5-dabc9a0e16bb", "value": "Revised order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b61c4a-cf2b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680202240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202240, "uuid": "09635c0e-74c2-43fc-b605-5fb55de81966", "comment": "Malware payload (AveMariaRAT)", "value": "5c72a278eea4555f1ce1035ea71fe05c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202240, "uuid": "28d8b74d-6c0c-4d62-aea8-53ee0443e7db", "comment": "Malware payload (AveMariaRAT)", "value": "9d23ef1df51ca5f49d86bf9790e32a441525dadd86c3435658e51a012c51e3af", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202240, "uuid": "f309f148-69c3-40e1-9388-3713965c9027", "comment": "Malware payload (AveMariaRAT)", "value": "dc54d9061b86771a60bfc0225e462fe620a2647a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202240, "uuid": "0a5353e6-2fd5-4ecc-b1dc-084fa9827665", "comment": "Malware payload (AveMariaRAT)", "value": "a4e3c5572cb62802d4e9b1182ae68c68580408b6909e28f7d5671907e0e137f359d278776e13333419a8562dd828ef6a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202240, "uuid": "6281399d-cea9-4654-b480-770338a51d0d", "value": "T1BCE4EF15E6DE850AD428B33E95E3D2BC2721CCD8E916CAD27BC9BD8FB2BAFC51115041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202240, "uuid": "fc10406a-4a27-44da-ac72-9bee6b735701", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202240, "uuid": "3b1f67ac-0d5b-40b5-a15a-989567da858c", "value": "12288:X7n2ziKbtL8X4dRqwFtr3cCZ5yS9Tx+pMhp1YVj9J9LJNbimOMt+:TlX4dXt7csySbNhpUT9LJNbimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680202240, "uuid": "403814fb-cf04-4b39-a27b-80d411bdb72c", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680202240, "uuid": "10ac9e82-675d-40f7-94d6-b2e8e4ffee40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202240, "uuid": "4b67dbe4-fa28-439b-be32-065e615ccdf1", "value": "Product Lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faacc6e9-ce93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137047, "uuid": "05d6c5ad-46eb-44ab-ab37-364298fcc7fc", "comment": "Malware payload (Smoke Loader)", "value": "da34ecc235609a0f0401882a9815e0a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137047, "uuid": "47b96cd5-cb99-4427-ad90-698ec8954870", "comment": "Malware payload (Smoke Loader)", "value": "9d56e843128da207aa63bacbd04b94c2928e2d409b0fd153e9715a4122cb7233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137047, "uuid": "48338bbe-9dd3-4acc-bca9-9bb11ce2d8f2", "comment": "Malware payload (Smoke Loader)", "value": "765d2708d9a916955af9c25642c8c64b29529ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137047, "uuid": "82f46e03-800b-44ae-a10f-fcf9c69cd8b7", "comment": "Malware payload (Smoke Loader)", "value": "ffb78ad34fd6dea39ec438e81e948d5ff9082993ef0c6733d9590263a710f5de31be7d832ea1b866a07aa13dd0cfcf04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137047, "uuid": "8cee9665-f28b-4779-8473-1a44bc54f576", "value": "T10644C0917692C87AD85B05794821D7745E3AB8324B16CACB27801ABD1E317D2CFFF34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137047, "uuid": "0a4835eb-e15e-4ef6-9486-e2c6d2d1aed4", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137047, "uuid": "52a5b463-45a1-4066-8e91-14f1467945f5", "value": "3072:HL9at9KJ8Xg2MX1Le64xgFUuywMNXq/x1kT5GSieluziI/Od4p7EnFUx:Bavhg2MFLe69FUDtNqxK617UFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137047, "uuid": "bb916f69-8556-4592-a1b4-5d1e8ce08ea7", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137047, "uuid": "aaf660c2-8481-4185-9495-131f009c8817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137047, "uuid": "ca052838-dfe6-4869-83b1-c8dea35fef7b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec09d95-cee4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680171575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171575, "uuid": "3017feb7-881c-4683-acb7-7e1187607065", "comment": "Malware payload", "value": "d639cf56b8dcc577a643287250046c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171575, "uuid": "528d60be-a608-448d-8c5e-5541e19a52f4", "comment": "Malware payload", "value": "9d85f7e7bbce1fc023353548d2bd1a54223370ccc64f073bcd473545aa36f6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171575, "uuid": "95d7e4a8-7111-41ec-99d5-9775b99741d1", "comment": "Malware payload", "value": "0e72c0ec1951efe8a5b215287132c55480600c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680171575, "uuid": "8fff9cb6-6a28-4abd-a7bd-223e6a88c812", "comment": "Malware payload", "value": "f63a7c4fb15545a26543e217d4e81f13ab11baf1edaa98add429a0e74c4b9286c355f09c164b1baab52022cc10af56b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171575, "uuid": "f2a1816c-5c40-43b6-9a18-ed922dcf7181", "value": "T1965733466FA318D8E4B66336C147E47872B1F9EA8334D3AF47F011661E936E2247AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171575, "uuid": "c4132fbd-15e5-4051-b0bd-0757062229d7", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171575, "uuid": "ce3576d2-4d17-4500-bfa5-dd20a52c7f6b", "value": "393216:8YXhkMAkBnBR1BbtWp3EqO97nasx/m3pHB20nlPSF3VJVvLuO+D21U/C7id1atd:8YXhkMAePcG3FzKHE0nlEJVzJs2Izat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680171575, "uuid": "24d87a4f-6a2c-4bf0-a3bf-4efb9b86192e", "value": 27999994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680171575, "uuid": "a0834164-dec9-4ef3-b230-4d37e0c31098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680171575, "uuid": "c5a60b65-2f93-4651-89eb-137863833514", "value": "FSPOOFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1869739f-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680161149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161149, "uuid": "95f23847-a26b-469b-9dca-3c6f43e2f577", "comment": "Malware payload (SnakeKeylogger)", "value": "8bfce4800db471254a1d934a23f3ff79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161149, "uuid": "6b6b96f4-647b-45a2-ac7f-b363de35ea84", "comment": "Malware payload (SnakeKeylogger)", "value": "9d9733c990a10a6793f5593c8bdfabfab16af78ff480e3aeb1b49e6b16529b19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161149, "uuid": "ebdcf883-a06e-4244-a270-5461490ec522", "comment": "Malware payload (SnakeKeylogger)", "value": "bdc4c43427092639836cda8e80ed263ba5dcb715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161149, "uuid": "57669311-28fb-40e4-8157-94da31f20360", "comment": "Malware payload (SnakeKeylogger)", "value": "20c9093773162285520f25d81a93a2d6f49facd25aa97ad69b443934980614f64114cd3cc7fc23331b1fff3d165a2494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161149, "uuid": "dac86cea-ae4a-4a5e-aae9-618d56d8eaed", "value": "T127954DF21193FDC5A72F1E8490442A409C181CAB97BC9658FCCD269BB3E5924DF9CAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161149, "uuid": "0aa3fd25-1dea-4ce4-a442-47c4f9c22622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161149, "uuid": "1f92e8b1-a1a9-4795-8494-41e9d9d3474b", "value": "24576:VCAB9Ot09OX7l348A5NyD7NjnXb83NpK/EAW3jWFCppyGEKO9b8HUxf/ZC3Bsaf1:kAmFnXf/ET3jW0OOhaCoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161149, "uuid": "fd999728-7781-4432-ba12-763829703d92", "value": 1989120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161149, "uuid": "e06f4ecf-e328-4b25-b66e-19da9e4736c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161149, "uuid": "32b76a95-f95b-40e8-a631-a42613325b22", "value": "Airwaybill and Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdfc983-ce95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680137506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137506, "uuid": "f6f9cb06-ffa5-448c-9697-048cafabb055", "comment": "Malware payload (Amadey)", "value": "453f4df6bba048ccf93cff1e39c0066d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137506, "uuid": "173c08ae-827e-4018-babf-b98892e3f784", "comment": "Malware payload (Amadey)", "value": "9da4c324d68d6ed54b5806385f9ab2410c26a0d8339c1e954e581e86943cc6ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137506, "uuid": "7b6584f7-0f5a-4903-ad53-56abc7c05031", "comment": "Malware payload (Amadey)", "value": "8b2c81bc0d81a70f2aa97317de5008a016d4500a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137506, "uuid": "c1c28ef7-6151-4dd2-9a39-74b967a78b73", "comment": "Malware payload (Amadey)", "value": "e10579da2f82842d7614e605b9b6ed9af303f09099869b8a993bff36c2e94125ec4cd87ae959eef54913e63021f0400f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137506, "uuid": "5c702987-7647-43c6-a31b-99304e8faf95", "value": "T18A44D0127691C876D51B05794812CBB8467AB8704B15CBCBB7445BBE4E303E28FF67CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137506, "uuid": "c54e0fa7-8d22-44e8-b280-e5866577c7d1", "value": "2d2bfb9c54ad9b595d71acc7d26596e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137506, "uuid": "fcf71871-567d-40f5-850f-e8f35b8ec0f9", "value": "3072:83/IzbpMfY8Xav9R3LKW9lzGcDjQOQFl6kRrTdDJSVWpqnhsWEt48K+//:/zbCjav9FLK2RMxlxJSVWpqhn6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137506, "uuid": "19116362-57da-4b9e-9aa2-18e630e88bb8", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137506, "uuid": "ea5b9c35-c3ca-47a6-ad44-8437e9646339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137506, "uuid": "9370f85b-94ea-4a2d-a722-6e426ac8cd1d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930f2a88-cee1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170374, "uuid": "ee161671-dd5f-4d7b-9572-5f6f4a6b3487", "comment": "Malware payload (Mirai)", "value": "3a9f3d0b4ff9551af61c7fc8fc39df1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170374, "uuid": "4a841760-12c2-4742-8c69-4978187b64c0", "comment": "Malware payload (Mirai)", "value": "9f886dc0d658304fc523e655ff54e15195de9461f64255bdf6f3a02c439f4685", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170374, "uuid": "4e1649ab-ad4c-4823-9641-feac919f2974", "comment": "Malware payload (Mirai)", "value": "2a797861938ba0c39dc601a8bb555b1ce2adcbfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170374, "uuid": "7ef9c36e-1bfb-4c22-8444-df80a2385fce", "comment": "Malware payload (Mirai)", "value": "efce08e13ba214476e9ab0bd82113f8934a85dfd46873c72fdf039a3edf470cae7450679da84f251aa183f09568a3c9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170374, "uuid": "c1cdf33c-2e73-4972-b6cd-1c928205718b", "value": "T16073F756B8814B11C5D512BAFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170374, "uuid": "deb0b71b-2243-4399-9634-eb21876521f2", "value": "1536:2lntExPgXkpdDHkM7kdxO4uO4W48agl00IAiGX3Wv+AcY5sYIWBL:bxIXCdEdlqZ8aYX3Wv+AcYuRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170374, "uuid": "b8d0ea56-6ea0-4897-9641-e309ff5989a1", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170374, "uuid": "5317aac8-1e01-4675-99af-774c408808f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170374, "uuid": "4b8e47a7-6b02-4cd2-8e48-e241ad282a09", "value": "3a9f3d0b4ff9551af61c7fc8fc39df1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab8833e-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680198358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198358, "uuid": "352f3656-ddb5-4cea-905c-cc6dcc7d8418", "comment": "Malware payload (RemcosRAT)", "value": "413ef5815459ab2723ff8f32718e4187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198358, "uuid": "fcc4adcf-c27c-4e0b-91cd-404b8689d3aa", "comment": "Malware payload (RemcosRAT)", "value": "9f9472ff68d38143574eebb20c6c45ad9e1ef8905c8a2fbf6bf5ff8ab30ec2f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198358, "uuid": "4cce70a7-ae81-4d58-8e05-e1f72a70fe8e", "comment": "Malware payload (RemcosRAT)", "value": "b662c53efae6e0ff43044bd60eeec0ec220860ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198358, "uuid": "e4b9b7d0-3e90-4d3b-8498-8484821276a6", "comment": "Malware payload (RemcosRAT)", "value": "bb37fed31097883c30eed88be6543199a47ab6ab97ec318ddf6b312cc3cd0ba7521510c44e0c3d8b10e597701ddd7b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198358, "uuid": "be119341-5e91-4f11-8c95-f95306ff6115", "value": "T1D5152312B5E9F4A6F8539674436E0A7A0DCC3D23A4F58FD6133E28A5F42B36E560A310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198358, "uuid": "c1c2cbd7-3f37-4164-95c8-3f0ff512c209", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198358, "uuid": "298ba072-97e6-4c40-a8ef-475716b9231a", "value": "24576:FYgqSY30JpTjQ6skrmlwyeqAdx3R61Xji9bc6xlU:qo1QMclA3M1Xji9wAlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198358, "uuid": "2872f98c-d891-420d-9482-fc07eeb4691a", "value": 876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198358, "uuid": "07d4bb81-2a4f-402d-b80b-cf0b8a0ea070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198358, "uuid": "1dfc3a05-b332-40cd-a8a8-4f368078312a", "value": "hesaphareketi-01.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c61a3a-cf4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680216219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216219, "uuid": "b5c0f71a-430c-40e4-b845-9c22d7169dd3", "comment": "Malware payload (AgentTesla)", "value": "09d6ced4b5213b3e493fc5313f111359", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216219, "uuid": "46d5111e-0669-4f41-842e-70bd22054820", "comment": "Malware payload (AgentTesla)", "value": "9fd33b8995e6f788ea506f1c89f88606ecc25833ff05f73d219280531c2f320e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216219, "uuid": "7d937729-87c9-45b7-b93f-e0737225f84e", "comment": "Malware payload (AgentTesla)", "value": "a42c77a9bc4ad6a47ecf24c67eb8711eacd13d68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680216219, "uuid": "30eec709-199a-41b0-badd-69ef03ec556e", "comment": "Malware payload (AgentTesla)", "value": "1c8ca7f9181371166d533c6d338eccd6108d654f4472f44a866787306f6854c1b704508d29b0faa4998447b16188381c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680216219, "uuid": "1fef2560-ebfe-42d6-963b-650a6c4dca89", "value": "T17CC4339BC39011E7DA7FA8FDC303D240D519B17AE6BE8A0467AD7F97939A10AC354843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680216219, "uuid": "17c77c96-35a6-4d39-81eb-39809f2323c1", "value": "12288:RfhqEzTGgmmnd9w0fpohBsN4HDCTP89y7gtm5dXqv2VYoaWI:phq0Ggn9w0foBsCjCAc7Em5d6eVBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680216219, "uuid": "b9fc46d3-b91f-4791-b464-7d6aa9beafca", "value": 559621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680216219, "uuid": "7c34919b-1c6e-4163-b545-9ddd2dc94fa2", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680216219, "uuid": "042143b8-2f27-4cd1-96f7-d11011408cc1", "value": "nPicture--1050_ITEMS.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35798e64-cf1e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680196417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196417, "uuid": "61224def-274a-4fbf-a942-0b254969afd1", "comment": "Malware payload", "value": "084f0d74d04cbec4287b39b7a2d0b89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196417, "uuid": "05b173c3-f83a-4155-a7d5-6c960860ce3c", "comment": "Malware payload", "value": "a0460d3bedbdd6aa525aa62d9161739f70f35b82b7878ae8923c60e701cb691f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196417, "uuid": "75ba7611-389e-4750-8b03-b554db55752e", "comment": "Malware payload", "value": "c0e1d08d945d20b0c2c0d47caee2bf4dcba8760d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196417, "uuid": "fc9c7b90-6116-49f6-8e51-30fb21861319", "comment": "Malware payload", "value": "49dea1445090c25d72442f74c0f4cc3e1bd3119d84a4a0df62bca39d3f176cbebdd128e7398f8ce3981d10a154cadef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196417, "uuid": "0618e4b0-8a37-45ca-a943-bc45e2b1fdc4", "value": "T19DB4227AEC12555FCEC989FBA6FF23F5630A53AB8AF105214E2C867C9C2D0211B5E50D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196417, "uuid": "c1a62a4f-0c5c-48c8-8eb2-ea5d99767f4f", "value": "0961a6d98c44c431729e6b8d357a57eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196417, "uuid": "4f7e16a7-b1e8-4f8a-9bd3-e944d9a2916f", "value": "12288:1NTHHJMuyeMHrc3Hk06r1ChLNF3EjtgLujUi5h9StzZjP1ht6WyYztzj:/HmupOoUrylEjtsuo4h9GZ7o58pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196417, "uuid": "f2751cb2-8e89-4880-8374-c73030c46ff9", "value": 531160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196417, "uuid": "1f34662e-3b29-485a-965d-4f5c113f3f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196417, "uuid": "123572b9-07d7-47ba-9a23-3a036b9a1873", "value": "222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a41ff22-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680161179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161179, "uuid": "c8dfe925-4ee8-46f3-886f-80b8ff3b479c", "comment": "Malware payload (Loki)", "value": "6ccc428d842357fb00f4c1391c5f2ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161179, "uuid": "9b177ad9-0225-477c-afee-6927f8f3bce7", "comment": "Malware payload (Loki)", "value": "a069b8c63e8a26aae2d4f58c151791ba79e865f654bf1d56dce67e551d7f8a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161179, "uuid": "43264dc0-763f-4ad4-84ec-dd75fa244dfa", "comment": "Malware payload (Loki)", "value": "28cae859d383d98489f71ed90773626efdb64fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161179, "uuid": "3ad36b00-43e4-4113-ae49-406f2166f12c", "comment": "Malware payload (Loki)", "value": "0450095c3f9cbd87a6cc3e01d217b72ed85106d096db586005a5b5323454e0ee277a2f415cc89d5e9088316387969b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161179, "uuid": "f03688d2-d626-483b-b0bc-83ac6e6913e7", "value": "T1C5D4024BB700BE56EE1F0931D42BD5D52790BF156BA0894732C8973F3612A2A43E97EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161179, "uuid": "25919b78-fdcf-4e4c-9d57-7303d239a658", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161179, "uuid": "cb2ca785-c913-48ff-b569-c429dd19fc86", "value": "12288:A0bOsuXcpn/eae1pl6rSqbptD7GrQp6sn7ppnas:AhXQ2ae1pl4bptXGrQp6k/nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161179, "uuid": "162d49e2-3f9a-43ab-b285-93e5b25f3b7f", "value": 628784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161179, "uuid": "52844b89-53fe-43f5-afe3-bda820cc316d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161179, "uuid": "50fee8b6-4a59-4c1f-ad43-bd2f22383526", "value": "RFQ (\u570b\u7acb\u53f0\u7063\u5927\u5b78) 2303ASI - 0330TW\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d554e5-cf10-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680190559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680190559, "uuid": "a238a914-733f-4cd2-903d-0d9ea5107e7e", "comment": "Malware payload (Formbook)", "value": "4223c53f0ee6221aeb66892e31784410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680190559, "uuid": "60a9c12c-6840-4b5b-bbae-2c9034b67a33", "comment": "Malware payload (Formbook)", "value": "a0e54cae680ce596c1b839d8afac471c19d86c7e506ece77dc28f292a1513b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680190559, "uuid": "b69616f1-6b8a-403a-8fba-e8400b67f77a", "comment": "Malware payload (Formbook)", "value": "be030f24e729ac86c3b433ec604857dcd39d7170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680190559, "uuid": "e5f3aad8-156a-4b63-9404-8aaaaf6854be", "comment": "Malware payload (Formbook)", "value": "ea63f09a7bf18a7d64fd0cf4e040eb03a918176b488d2d8c405b9d823dee0a8d0337c0316ca5223759d6dea935dda70f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680190559, "uuid": "a7211429-e064-4e93-a1ca-5e6633fd8ab0", "value": "T1085423563B74C5E7D6A30A721D3C4394ABF79626206CB60A0B80DBCC7E25D41EB2E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680190559, "uuid": "edff8603-96a5-4951-af35-4bf876af8ec8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680190559, "uuid": "439a4a3a-a427-4a43-b366-bb555494b41a", "value": "6144:/Ya6YEpwUnSz5NGhyDQDEJGZ0y/QRPFbX6CgiArjeIl:/YO0wUG5WDyq0zRPFbX6Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680190559, "uuid": "070b763b-7b39-47fb-b4ba-d4e65db7d091", "value": 293475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680190559, "uuid": "0daefbb5-9a5c-4786-bc81-3af94266e9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680190559, "uuid": "9b53efa5-2976-49ec-85ea-7386c4708542", "value": "Swift talimat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47078908-cf37-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680207184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680207184, "uuid": "bdb4d8f9-0baa-42de-a7cb-a9427f535e53", "comment": "Malware payload", "value": "b1e41a16cc3c4def7097e69473e90d40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680207184, "uuid": "6aee8397-8fdc-4bbc-a750-e6bc62dd8359", "comment": "Malware payload", "value": "a0e5c335f0f479fec56a0e214fe7657e8d9b6f77cf5db53280ec1033c1dd2693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680207184, "uuid": "eba98e4f-619c-4aef-bda2-52fa0f20aeec", "comment": "Malware payload", "value": "6da91b0d3ab5555bb0717db6c776ab7f3f0209c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680207184, "uuid": "fd887baf-63a1-4bda-9f3e-1193d162c56f", "comment": "Malware payload", "value": "ded006e5574c00054306907f3fa4e340ff862945375a0edd0c3072ce457c33c02fc05a8b0cddb3686762ddd13538b289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680207184, "uuid": "55a05f8f-754b-4326-88da-6f1e970263b9", "value": "T1BAF4E014E6DD8109C919763A81E7C2BC5326CC99DA26C7E27FC9BC9FB3BAFC64415042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680207184, "uuid": "fd34a847-e5d8-4bf0-beb8-5fb424e70e51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680207184, "uuid": "74732aa3-394e-40c2-9f6b-d5c497b3210e", "value": "12288:X7juzVKpxgcnBQD3zFW7DgOM0TIwlborrJWSGxgkwVimOMt+p:UggB3zFaDgO3TIkoXJWSG2kwVimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680207184, "uuid": "0f36b87d-5211-439e-852f-692ea39d6c21", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680207184, "uuid": "afb83ab9-31fd-4b36-a4f7-5a461038a980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680207184, "uuid": "12a07a1f-624a-42ab-8140-805e11ab56f2", "value": "Solicita\u00e7\u00e3o de cota\u00e7\u00e3o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf28c38-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680198387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198387, "uuid": "f2bc607a-654f-405e-a1b0-35862df2bcd9", "comment": "Malware payload (RemcosRAT)", "value": "d08f6dd2d4246ff07749ce6bd728ba49", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198387, "uuid": "248e7303-bf27-4dbd-bed3-aa62069bf464", "comment": "Malware payload (RemcosRAT)", "value": "a0e66c7ce9c8723a9a8030627c04bdcbaee53917905f96f17a51e0d6a912fed8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198387, "uuid": "179460be-246b-4d3b-aabf-31e4a69c3678", "comment": "Malware payload (RemcosRAT)", "value": "1f7855b2d83da120a48e4148ecbd2d9582ec01bd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198387, "uuid": "0ee74c4c-0db6-469e-a0d4-715b04c10003", "comment": "Malware payload (RemcosRAT)", "value": "277cbf52f14a91c8a0ce58fad5db193eb224387d61a5d7a7684537dd7bdb3dd4a56cef3334c235620aa84e3cbae74dd4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198387, "uuid": "d8e6c872-6d04-4077-a462-04caff8881ca", "value": "T192F4019013BFFAA0E9EC5BF454B7817D422090250E1A82D70D56EEBC21DF6D278BC6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198387, "uuid": "0e225ef8-dc87-466a-8e7e-045dacf9b8da", "value": "12288:bLdgq78qnH/CqtF5Pu4N311KNAtt4pJDg3DOp+95VlDEVoxG0n1WUn:Xb8SxPu4NJMpJD2DOc95V9Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198387, "uuid": "8237dfbe-8df7-4376-ad20-6337d7d83a28", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198387, "uuid": "93f8190a-3de4-42da-b924-27d29fc9e368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198387, "uuid": "2da670fd-15a5-467a-be75-150d15559aff", "value": "DHL_8812202816310TD01_20230228_17600_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715d57de-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680159151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159151, "uuid": "8d6472ac-8eb8-4188-8763-1eaa5ddd3ed4", "comment": "Malware payload (RemcosRAT)", "value": "8d4f819ceb37412e81990baaaf4a5f4e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159151, "uuid": "ebb5586f-7df5-4890-a807-5c6b61eb131a", "comment": "Malware payload (RemcosRAT)", "value": "a0ead8e5349d0557a75a179a5b4e61905f8c3fbfe19f5e881de8fea88d322004", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159151, "uuid": "f7a024d6-9ba6-4760-8381-0d50bc5b86b9", "comment": "Malware payload (RemcosRAT)", "value": "927d61c69260aa191a52b7ed6610b7b607e594e2", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159151, "uuid": "b1c09c4b-0241-4f8e-bf4f-556bd057c859", "comment": "Malware payload (RemcosRAT)", "value": "6f190c300b44fc11fcf494551c61624fb7afacedc9c6aeb30a7c126dbf7faaed588d2aac8c868157a0ec507a6bfa3b22", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159151, "uuid": "31bc84d6-e0fc-460d-81e6-e979f9d11655", "value": "T1383533D7E9932EC89945379EFFA356F6349DB3119C721FAC26A7740287790D20E460C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159151, "uuid": "2d57d556-aead-4a15-b7c7-8df3c8267745", "value": "24576:pfmb28mF6iOkV3jmY0JMJjRGHB/chuFl6CnIZwvHSNFZhM:pfpbo14mYxFGHyhRXPDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159151, "uuid": "08964ebf-f5f4-4f91-a73c-a40cf2f38759", "value": 1071968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159151, "uuid": "5a07e5a7-7d1d-414b-80c5-d4c804f3a4f6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159151, "uuid": "607f3f76-f0b5-4a8c-a4df-b8d9e02e192c", "value": "TNT Original Invoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e90cbb5-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196808, "uuid": "630f15bf-7b39-4412-ba3e-86f534117d9a", "comment": "Malware payload (SnakeKeylogger)", "value": "d09ccbb9ce55d3b5d605abe11e410a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196808, "uuid": "314dcd4c-5594-4a76-9731-b94d733b63f9", "comment": "Malware payload (SnakeKeylogger)", "value": "a169500a6f1faf4723178e5fc17ee30449727bbc5db3e7fece650a833ccdb9b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196808, "uuid": "9cdbe95d-e820-4f07-8821-0269bac3f828", "comment": "Malware payload (SnakeKeylogger)", "value": "558cfb0ff8d8c25e4de6ca7aa27edb8843f0bbf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196808, "uuid": "8a72e96c-d5d2-4d1d-ab74-9edafbd0d14d", "comment": "Malware payload (SnakeKeylogger)", "value": "00ff23cec0f0e9999b2fb34a6381a717aca0219b6a368b6ee3a95962b9338529f3679da7dc737860987b420b57722f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196808, "uuid": "b38fde99-a36c-4381-85a9-fe654e78f736", "value": "T151D4021477DD840FC01ADA7E81E5D2B063B1CD95D6A3DB634FC9BC93B38E39665A2082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196808, "uuid": "27b224a1-42c8-43c8-abe1-2b7d908d36aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196808, "uuid": "8d548f05-d84f-4228-b884-d2dfd45759fa", "value": "12288:jQyv5pDWPNxIy2c2Zr34bJ4LIO+R+DvmimOMt+Z5:jV50VxIJMycLOmimX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196808, "uuid": "70a956a7-49c1-44e0-9c1c-0d59612344af", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196808, "uuid": "e99dd41f-35bc-4898-8ba6-91ed4f2e9f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196808, "uuid": "28ed2121-5b2b-47c0-906d-150bd9ec2072", "value": "Garanti Swift mesajiniz 30.03.2023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b103aed-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180508, "uuid": "39253bf4-326f-4b88-8f04-f6ed38fb1aa4", "comment": "Malware payload (AgentTesla)", "value": "1d997c9b6e4305d8eeb9c79cf98def34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180508, "uuid": "9eee6ae4-e9b0-47ee-afe2-3e0448c25383", "comment": "Malware payload (AgentTesla)", "value": "a1a23e7eeda0bda15a7230e93d9aa488fa85fb81677854856c336522c1f915ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180508, "uuid": "bd97538c-186f-435b-bae1-3b3d5660a950", "comment": "Malware payload (AgentTesla)", "value": "a7f4d8e5beccd10deb2494ef0d463b6cbbc53671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180508, "uuid": "7d439e73-e2ea-40c1-a778-2703b08e1f15", "comment": "Malware payload (AgentTesla)", "value": "45527cfd8f76c835c06a524b901c61ef973d3db6641d80f3839940c6c24b7a8ad2d0265fe5d56c9375aea0fac4979acc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180508, "uuid": "81e526ee-f3c3-4aa0-a23c-fe32ba1d77f7", "value": "T1E5E4011436DCD649C016937E81E0D2B1B739CC99E522CB230FDAFCE3B38E35AA525196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180508, "uuid": "d0d798f5-9333-4314-8f41-6ff5586c70f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180508, "uuid": "eb532496-80f3-491f-a94d-ba7b123136f2", "value": "12288:RnL/BvIoZ0KEfkJP5n31AAVR4h6ZKQJPOahoOg0Pt/SxMQxXKWimOMt+:RL5AW0l6IYfAE3xPtKqQxjimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180508, "uuid": "0d134805-6f70-483c-bf8b-58ad3fed34e6", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180508, "uuid": "09f945a0-9b2e-4827-b141-507fd6e2fea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180508, "uuid": "d9b7cb8b-3d65-4dda-892a-5a5019fa63ff", "value": "Payment Receipt 50039571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934eddc9-cf05-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1680185837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185837, "uuid": "0cae1c3f-0a03-4b00-bc0f-bdd1f2bb03b7", "comment": "Malware payload (XWorm)", "value": "72b0a5179a088aac3cff7c072b60024c", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185837, "uuid": "b4cb8d3f-0646-4bd3-81d7-0f74030c2384", "comment": "Malware payload (XWorm)", "value": "a3c0a370c5491114d6fd3f2fe5c3e7110153f93bf1de0283a742691520a9d266", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185837, "uuid": "cf4d1759-6140-4a4c-87b6-2cfaca12a8c8", "comment": "Malware payload (XWorm)", "value": "744c573807de315559d0e6095cc47ed8e3f82bac", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185837, "uuid": "efd46b7b-6a87-4e30-b1be-6a63244f307c", "comment": "Malware payload (XWorm)", "value": "485b5117d2548b76fb76d362a092be269de929c92d97a73491d6bf429409dc3fc5a1c385073199003c8e943ef3d7b34b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185837, "uuid": "30f1af90-e460-49e3-b38f-7a579be4fde1", "value": "T19F35951661A60F84D95C117994EF1F4637ADBF4A0916E38F5339E22FBEB36F89D20402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185837, "uuid": "74499a46-0547-40e6-b6ad-c2ae7e907d23", "value": "1536:EsgB9woPR6fJEVoTX+/Xi+i2jYwY/wRiX8lMm1MgKkNy:EsgzrJIE6b+/c0d8w0XZgKkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185837, "uuid": "f16f0d19-4ed4-42f4-8bd7-7d9b40c2149e", "value": 1116323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185837, "uuid": "25b37dd6-4d1d-4e00-a9c3-6ad2726525bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185837, "uuid": "3ca26ead-59cf-4034-84ea-e78c05902b73", "value": "a3c0a370c5491114d6fd3f2fe5c3e7110153f93bf1de0283a742691520a9d266.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e22eaa-cedf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680169386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169386, "uuid": "d9ac1a74-d641-433a-8ee9-56fc886a88df", "comment": "Malware payload (SnakeKeylogger)", "value": "3d5f9205b4a53d55ad7ad270a9bd9d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169386, "uuid": "ed47a4e4-24d5-4e59-9b20-b670cc1899f4", "comment": "Malware payload (SnakeKeylogger)", "value": "a3f7da2fad4025f5f0f1bd3ba1e05dc454598a98a8890aca72ed747f604203cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169386, "uuid": "ff581de4-03b5-4e62-8e26-03f28fc0b5a9", "comment": "Malware payload (SnakeKeylogger)", "value": "aa5ac5c045b150d2a64899578ca7924a6a3cc6be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169386, "uuid": "6bfc52a0-a349-4e5d-9f2c-5d0ef975fd7a", "comment": "Malware payload (SnakeKeylogger)", "value": "80d825b773a6258462499fe719b900f89975d63e0a1a7903303d90c4d77e732278a7b09ca1b0cea793b644f5c16c0a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169386, "uuid": "fec4c0b2-7e51-4ddf-afd7-a2c65df8d089", "value": "T183459ED1F190889AFC6B0AF1AD2AA53025A7BE9D54A4810C55AD775B36F330320DFE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169386, "uuid": "37b3efdf-c6a3-4181-9369-dc36b60c0817", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169386, "uuid": "87534506-2bdf-4c8e-9971-df7fddb56553", "value": "24576:YYQId62SU1Lab1qFtBS9lETBQfkRb1Q8Yk1O:z2U1Lg2XS9lqyfkRb1Qbk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169386, "uuid": "901394c7-e0f7-496a-9ef9-aa3be3d22e2a", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169386, "uuid": "6f160568-b5da-4a35-8bfb-5b5f25c1b87e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169386, "uuid": "13663251-c06e-4017-92b5-66fde82b71c4", "value": "Sat\u0131n alma emri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6c205c-cf08-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680187169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187169, "uuid": "36457478-5778-4d31-ad43-5c93306048a0", "comment": "Malware payload (Rhadamanthys)", "value": "72725227135bca14352aaaff6411542b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187169, "uuid": "17f88980-8a6c-42ec-a266-9c499f0ed829", "comment": "Malware payload (Rhadamanthys)", "value": "a432bf6943599e53a12d5615f91fe3d636a6820073b60a7068fa9508849806b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187169, "uuid": "57eec3b3-bcf0-4f3b-8198-f59ae36da147", "comment": "Malware payload (Rhadamanthys)", "value": "15e7b28b530816647be3a17bdf7e399bb21f62a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187169, "uuid": "35d65df6-73e4-4238-9bec-d9e485ae3bf4", "comment": "Malware payload (Rhadamanthys)", "value": "154eb1ec769510afc958c3c5419bc787c9ea62fd8d548859d5a150cff5c039fab077cec8fd62270a0e19faec849b4eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187169, "uuid": "d31335d5-2c9e-41a8-a32d-7096006b8c8e", "value": "T131549E129EFC7C30F22347368F1EC3F4261EB461BE55BA5E16856A6FC5B83A1D262311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187169, "uuid": "f6f33e2e-eaf2-4257-88eb-d9bdee889bbd", "value": "9fa9386b668592c6b6f4c3793199047d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187169, "uuid": "23ec0fee-2406-48fb-a3dd-2328d7226bbe", "value": "3072:ekZ0XRP9VADwpAq19kuJKM76/WRcVBHEz+G8O8nxIDP9nR5rnjpSo8/1Ozsk4VWw:v2VMwsUcV6hIIhr1So8/1SsksX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680187169, "uuid": "f9b1c4a2-d97b-47ae-b672-679da1ce483e", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680187169, "uuid": "8af66615-d1d1-48be-a6c3-de6dc9ea49da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187169, "uuid": "e4430773-1b5f-4fed-b7a9-869ad01be2cb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b737ce20-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170865, "uuid": "b69d3757-2835-451c-955b-5fe1b6eee226", "comment": "Malware payload (Mirai)", "value": "e6a23c70fa7536bfd770105da07b4c5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170865, "uuid": "7c9bbde5-979a-4865-911e-efef73c2996a", "comment": "Malware payload (Mirai)", "value": "a4fb25b4b0c74fa6dc72603f7e2308beac028965097521eb9f454ed1919751c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170865, "uuid": "dbe252f6-3b46-44e3-8670-14dcf2b274db", "comment": "Malware payload (Mirai)", "value": "2230e0eeb237779f09dff40a1e3499c1f7cfe002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170865, "uuid": "895986ee-dab9-46e4-ae2a-0f5a9904a98c", "comment": "Malware payload (Mirai)", "value": "c7578985f14e98fea340df641d817b147e481a389a674bf48830d517ce36c26e2ee1cd1ef066784fc56abcd27a14eb4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170865, "uuid": "fc50e7d6-2b77-401f-b80e-2b3f1341d707", "value": "T1BEE33C56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170865, "uuid": "5dc04523-3d6a-45ce-813e-040e3b73c86c", "value": "3072:eJLce5p0pHdPS0aCHbz4NvMLJF1IQ1FDEXMk/M/9IQkY:eJLcHg0aCHbz4N0LJPHDEXMcM/97kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170865, "uuid": "d13f6f0c-a8a3-49b3-ac9c-24b0a9bacfd0", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170865, "uuid": "0e4461d2-9ad6-48a1-95b1-59bf30eafed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170865, "uuid": "cab4c7f6-be7a-4339-bed5-bffbcf5d9b4d", "value": "e6a23c70fa7536bfd770105da07b4c5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5bea73-cec8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680159520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159520, "uuid": "52f07f7d-e5f4-4d67-80cd-9cd87f661b2b", "comment": "Malware payload (AgentTesla)", "value": "56defb4b4ae2d0946987dc1a15e24e96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159520, "uuid": "e2965469-44b8-4a6b-ad32-fe715d437033", "comment": "Malware payload (AgentTesla)", "value": "a53363ea889b7c38e656a2bb9a8da89c8806a3198bd443bfcc438410323ba1d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159520, "uuid": "ab3e2a10-0078-4feb-98a9-160b1de535c4", "comment": "Malware payload (AgentTesla)", "value": "f0cfbc5ad6cd8e756792904f7ee3107379b2a1f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159520, "uuid": "d0cfaae7-e75e-4385-bdf6-6e28515e346c", "comment": "Malware payload (AgentTesla)", "value": "e39c3176ca9a5a5bca393ebf18930eed85cf357cb9af336a9f536a19ee7c722f8e3d0c9b29939c8117161e77256ebe07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159520, "uuid": "cccba191-0c61-40e7-b03a-63859887699a", "value": "T18F0523D687E7BFBBE79F217403E4D001B5962A66259073D36728DC814A3C5B9F3A840B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159520, "uuid": "765704a4-b603-4e98-9171-a5e159022b94", "value": "24576:JptzrDDYKanQB5w1dpIYvyunve/OiTSby:TtnPlaQTmp3FCOcSby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159520, "uuid": "f02601ba-604c-453d-a986-17d3566b5854", "value": 848757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159520, "uuid": "18106cf9-6070-4f49-aa72-7c8d01b2a6a0", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159520, "uuid": "a316e7bd-fdcb-4f7b-9a9a-c9a036b80d72", "value": "prodotti nuovo ordine.BH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0c9eaf-cebe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680155520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155520, "uuid": "8c0d48d9-d441-441a-97eb-a8cf493e9aef", "comment": "Malware payload", "value": "36161b6afed04c084470a703b3d8f50d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155520, "uuid": "9a6f7c72-f5d4-40e3-b80b-a8a018d6e7f1", "comment": "Malware payload", "value": "a5a4284f87fd475b9474626040d289ffabba1066fae6c37bd7de9dabaf65e87a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155520, "uuid": "1437f586-ace1-49ad-a8a2-c89b5e3e8b81", "comment": "Malware payload", "value": "fb43a4e3ce54ba0ebef9629d15118b05883dbe9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680155520, "uuid": "d02a1664-a1ef-4412-971d-ca9d196f85e5", "comment": "Malware payload", "value": "6b9400daac89d269e1c2afdcc5e9ef016baff6b3f88f0a2c01576c27f4eb888a15248e9b5b867de72b461f69d534cd47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "melofee", "colour": "#1AC18B", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155520, "uuid": "7357c52b-9c61-46b0-aca1-115da2aaf3d9", "value": "T116E57D27B9A214FDC59BD030975F8172AD34B8E803207E7B2395DA303E66EA01F5EB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155520, "uuid": "581ca7d8-b041-498f-9804-888d30790ced", "value": "49152:YSWZhe0h8V/kIdVe7v/xza4eJ0HkgooTiX9k5crv1vIRmxMIU6iTJ8tPSmEQ3pXm:YSlyHxsJ0HkgN2qcrv1vmmxj+TJszbpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680155520, "uuid": "86ef70f4-36b6-44e2-b9f7-7ba839c03e37", "value": 3127560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680155520, "uuid": "2b78250a-86e6-49a6-929e-d5d5ac8fbe3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680155520, "uuid": "fc528ec8-b28e-45cd-a2c8-106c4b388db7", "value": "a5a4284f87fd475b9474626040d289ffabba1066fae6c37bd7de9dabaf65e87a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb46f1ed-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680185125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185125, "uuid": "1040856e-3caa-4cc0-8484-5ae2f119c622", "comment": "Malware payload", "value": "50c49646b874ece55c1e614250202db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185125, "uuid": "510b9dad-2203-4f78-ad66-19342e7cf5d4", "comment": "Malware payload", "value": "a65a1e352683e6567ce28623fee75c48d5b9b62f33e5af9b3f9372de2df5d6f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185125, "uuid": "ad927fb2-749e-4b1d-85a8-9bbd556f790e", "comment": "Malware payload", "value": "800150cae4b49a6d76b6769789d17166f7398116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185125, "uuid": "0541e939-afd0-42c1-a750-d411acf42f77", "comment": "Malware payload", "value": "adf6658cc8e71a501589be2fe09da7f7f2724945b61509ddc52a27a7f0b59662a46f81b5694f24a005b3b6061ce367c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185125, "uuid": "8c0a7809-6c64-489a-91a7-ba02dc9e2e03", "value": "T1B6B6336E4A81C714F4C210FFA259C94F07EF03A4612EAA27F73736BE27615C19C36269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185125, "uuid": "aeb5f4fe-121b-402a-8c40-441ed5970faa", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185125, "uuid": "e2637449-3c6c-4fec-8524-4302875d5325", "value": "196608:mlnp060SgEhXHyrWvhLz+RuddiQV9mTZoScJB0K47GigYfCITFwNHsE4CSF1E1q:mlm8XyrwvEK9mlonz0x7GMfJwNHsPo1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185125, "uuid": "fc2b4d34-6bb7-4f74-8d4f-44d7b7c65ab4", "value": 11219960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185125, "uuid": "320a43e1-27cb-480a-aeb0-bce1f5f5a10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185125, "uuid": "70331843-a254-44f8-b383-28c1f3be2d40", "value": "a65a1e352683e6567ce28623fee75c48d5b9b62f33e5af9b3f9372de2df5d6f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d95809-cec2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680156873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156873, "uuid": "1255b87e-a44b-4deb-8cb9-cf3f9a70fcac", "comment": "Malware payload", "value": "251f90f9b4932f72b2f0e5c90f5a8f21", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156873, "uuid": "c5bc0515-ef01-4542-9dab-6b3bb68a6cba", "comment": "Malware payload", "value": "a6c4ee635b761ca4a2e5d1f30ef7bc84cf908943c2cd7bb40e5ed35f91163fab", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156873, "uuid": "182b21cb-3b40-41bc-8272-617518893157", "comment": "Malware payload", "value": "bbdc7e8b4fe593e5752b6d9db1331d64be4d5a8d", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156873, "uuid": "7c140049-26ee-4b98-a31f-999f71dc97a2", "comment": "Malware payload", "value": "cde3d8994029100f52641d0fe814556428ccfeda66b694e5b7b8816716ff740b361dbe5ce71b1352faf0ed574e2637b2", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680156873, "uuid": "263353dc-eb5b-499c-bd3a-e11c30fbf4fe", "value": "T10EC322E43EC2DAD185AD0E4FD78C4A374B63B35B0546DEB57F500A8209837A9B76E093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680156873, "uuid": "95a8f71b-761e-4f4c-ae79-29ae8a32a81a", "value": "3072:WK8ogF2uXX/YHFCm2HacGU5aWjgB0/hwrI:L8ogdX/YHsm2dgBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680156873, "uuid": "e8639fbc-548f-46b0-9e0a-d2ed475a31d2", "value": 125859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680156873, "uuid": "64350ce9-e5f2-4d3f-9091-487b8cffe383", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680156873, "uuid": "00aaea32-8869-483e-bfca-262bd59073f5", "value": "download.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92910784-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (NosuStealer)", "timestamp": 1680161354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161354, "uuid": "74a56224-787a-4269-b3bf-d8cb54851991", "comment": "Malware payload (NosuStealer)", "value": "5cf29bda0befe7a66cbdc63ab4d6e311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161354, "uuid": "f41a0323-2724-4919-b0de-bbd5a02c5c7c", "comment": "Malware payload (NosuStealer)", "value": "a7583ffef57b30690f06923de93b2769038639910ac1324160fc50264491edc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161354, "uuid": "0afe4524-fd2d-4865-a3ce-30a1e74130a1", "comment": "Malware payload (NosuStealer)", "value": "3f0e5daa141b22625603091dc7b7a92f5a41a595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161354, "uuid": "0714ae96-e066-4407-99f3-66095017c207", "comment": "Malware payload (NosuStealer)", "value": "f0966b55080497096d5d99fe5e6d57e97a768360e88144da56ecf984025dc81c603a8a0a5e406917fc8b292fb7cf6668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161354, "uuid": "20b988bd-1587-40fb-ad50-a96f295ab23c", "value": "T1DEF49F22F2E18437F1322A789D1B927CDD267E106935E8463FE59E8D5F38681372B193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161354, "uuid": "be8e207d-1a6c-4e6e-b21d-74c699c41b22", "value": "97097c6816d59e0e343951d5da613aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161354, "uuid": "ad8cda3a-0e31-4b32-95d1-0b22005c33c3", "value": "12288:zPDiJJG05qrVujzjkv45nG2JoGhkgGt4z9CqCb4jyKrxo6EbpYx0:rmb3GVsfkv4I2Wi0t4S4jPG6Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161354, "uuid": "bf9a49ff-062e-48aa-a43d-31817a806a08", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161354, "uuid": "762c252c-9c1b-4539-ac50-f079bd924ab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161354, "uuid": "a2de23fa-e5ea-4305-ac71-a16923bef439", "value": "5cf29bda0befe7a66cbdc63ab4d6e311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e85d5e1-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161589, "uuid": "c29daf54-6952-4bf2-be5e-8ae8493e239d", "comment": "Malware payload (AgentTesla)", "value": "87a0518430f27f497e7d311547c3cc49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161589, "uuid": "77d1e0eb-3017-49a9-98e4-d927d82e2b0f", "comment": "Malware payload (AgentTesla)", "value": "a7c284be487a9a722313747a9d976173d074e4463ededc53668cd925b7793147", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161589, "uuid": "ec1daa5f-c847-4334-b19e-8aa6d45de974", "comment": "Malware payload (AgentTesla)", "value": "3105b3ed593ca26a4faaf253c8ad037a8adacf8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161589, "uuid": "a97d492a-4b1a-423e-a07c-2130be5ee1f7", "comment": "Malware payload (AgentTesla)", "value": "9973e31cd0c156cfa2d6582447ad0f994d7204e2454579bf454a8f19dc6f6728859d9ca2ae4380bdc61ad2e09ecb8677", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161589, "uuid": "5cca85fb-f21a-42dd-8917-07fc7601813c", "value": "T17415D06B28484159CF3861F7522E406423B5CCBEC624DB869F84278BEFD97924E3D71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161589, "uuid": "ce42d6ae-af38-4dbd-a343-67896ab91298", "value": "12288:d+nA3fWDsZt6wlr0T4ytyFAGuNPeG9rHJRhip1qJv6nnjqKoea:AA3fWDsT6wl0ByJRG973CqZ6nnjqKoea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161589, "uuid": "79d82035-9918-4d08-a760-0dcc2d0764f8", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161589, "uuid": "d27394c0-1636-4ca1-9b2d-687a8f89b7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161589, "uuid": "9eb05a58-a82b-4dd6-9076-ed9516a95ef1", "value": "QUOTATION#235878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75709589-ceaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1680146702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146702, "uuid": "151e0c58-e2e7-46a3-a24e-1c49b7ebe7c3", "comment": "Malware payload (Chaos)", "value": "c75e5e9aba9493a03d7861aaddb6dff1", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146702, "uuid": "573c6a89-ff73-43fe-9ace-3efcc18e6ef6", "comment": "Malware payload (Chaos)", "value": "a8907e6d1d4bf74eec05db1fa80281d105ccf30aae0f26ab2bc25fe1a429b706", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146702, "uuid": "a8977a81-25c4-48bf-bf14-12946ef23579", "comment": "Malware payload (Chaos)", "value": "141bdbfcd0ddc93f07088609697bff47d7afbe98", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146702, "uuid": "d958aca1-7170-406c-bb1b-5ad60d285200", "comment": "Malware payload (Chaos)", "value": "495f81bd16717b5ee62d2cd44eebd3d3b88519e1866e281c535941dd0874a2740b447d40ba064230481724989a661f5a", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146702, "uuid": "d66a9e1c-052e-43e9-ac0d-7c6f95a53ad3", "value": "T12003B6143AFB9429F2B3AF785FE470969A7EF6236E0AD45D1085034A0A23F85CD90639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146702, "uuid": "61671026-5a2c-4031-8f4e-fc3a40d39dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146702, "uuid": "6dc31b4a-eb3d-480b-9362-a16119db96d7", "value": "768:Zqo2u5EpJjKtyr9atIW6sALRV04eZz2ldhnXOV2lD4kPIX0eM:so2uyjKtyr9ayddjo2ldhnCHkPyJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680146702, "uuid": "51dd8280-d2c1-4e84-9ba0-1436c649fc5e", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680146702, "uuid": "3009e569-38c4-4fac-89ed-74f55ea800f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146702, "uuid": "e5de3e99-4b3e-47e9-9123-008a803eda64", "value": "2023-03-29_c75e5e9aba9493a03d7861aaddb6dff1_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42efee4-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1680161088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161088, "uuid": "9cebe6ab-936b-4a4e-a4c2-5bd1efb034aa", "comment": "Malware payload (NanoCore)", "value": "2c9847c76f51b2c6a2fe2abe4a9c91f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161088, "uuid": "9be98069-4c63-48a4-a30c-1636b482a621", "comment": "Malware payload (NanoCore)", "value": "a8953f2dca5171e14663eefb973c1793decce1dcd6c7baa63081a3d681dbc1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161088, "uuid": "0af69350-c1dd-446f-bc0e-5ab6f1bf5b41", "comment": "Malware payload (NanoCore)", "value": "e3d0facab5b7671ccdac2476a699ab2f817b4479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161088, "uuid": "4f6e891a-bcd9-453c-82fd-60afe3d4ad2a", "comment": "Malware payload (NanoCore)", "value": "cc9a7b7cdc2412d0425e897d69c7b258182378083b8698071bcc05eadbc0eed323f3a2f26ecdc12cf2396550cfa2166e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161088, "uuid": "f993c9d0-380c-403f-b0b6-382d2aad4abd", "value": "T113559E56D78CA9CCE3566C725878452190ABBFCB896D811EBC3639A680F13C1393BD4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161088, "uuid": "60fbb21d-43a2-4c06-ab01-a185f8a0249d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161088, "uuid": "e7630cbf-3eb0-46ba-b384-8ca11a399e26", "value": "24576:9A5IeDQd/XJwtr4Xqfbd3TFZNoDoAyfiF1geG68Nq9H9Z2839Y2YXC8bx7wwI3n2:25/QR5wtr4XEbvA+iF1geG68Nq9Hr286", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161088, "uuid": "0d513598-1e68-427a-addf-4a71815f9732", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161088, "uuid": "65dce0b4-1fd5-491e-bcee-050a31cd332e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161088, "uuid": "1ac1f0c2-f34b-4d08-9c3b-3d26b01c9fee", "value": "YWjESQ2siMOeTGY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914fe142-ce94-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680137300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137300, "uuid": "541b2b31-5bcd-462b-bb7b-cfed1e9c0252", "comment": "Malware payload", "value": "2807ce367d65d1d80ea563097d7a7a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137300, "uuid": "c3dbf2c9-d5d6-4342-b051-15d7de52792b", "comment": "Malware payload", "value": "a8ebc2f5c78093046ccdc96ed499b3bd263e95b53747ccec408858af6805bf82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137300, "uuid": "12ca4e58-5561-4486-b562-b5414573412a", "comment": "Malware payload", "value": "650bdea392dac369a877bbd032c82ff175fe69a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137300, "uuid": "49495bfa-13a2-4d55-8b9d-244dcf7ed1f4", "comment": "Malware payload", "value": "1a5d796244f14c8b8b24a8d320c0b058fffb489f7efc6c414b15b2df306cbbb70d49c0c5073421966f333a7737497893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137300, "uuid": "74a6f54b-4a7f-40df-a37f-e49b87442789", "value": "T16A944916A1160E8BD57A72FC4841E735A3713FDAB352C29B06B0FC2EFEE5E904C61691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137300, "uuid": "b0c5c0ba-9fe7-439d-8051-b5f8216095e7", "value": "78da59308ee0088a874b4a6cdd7d91bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137300, "uuid": "7518bdd7-0e6f-42da-99dd-d0e10a1df9d4", "value": "6144:rDTojL6Ed0YXwBx1X2gTiPHqAZ/exrdKV2:rDToXd0YOX2aQYxRKV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137300, "uuid": "0b3ed70b-3175-47e0-8380-8b1a89f79520", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137300, "uuid": "d42f8d20-80e8-4871-b22e-68422e8aaa39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137300, "uuid": "84fd5e2e-ec5c-4705-86d1-13b2b9a68bd0", "value": "Phoenix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59319ad7-ced9-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1680166841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166841, "uuid": "851fcf69-55b8-46e3-aa61-258055388b7c", "comment": "Malware payload (NanoCore)", "value": "c47bb4cb98316705617288bbe59667f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166841, "uuid": "b7fc58de-eeb1-431e-8363-5d5b8c178a83", "comment": "Malware payload (NanoCore)", "value": "a955997c08ed97f83968344c9eff0a4789683fc99ef1872c6bf223990c30cdda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166841, "uuid": "5c5219fc-4647-4bfb-b4f4-24ce2d103a9d", "comment": "Malware payload (NanoCore)", "value": "e5b84e94f268a1a45e8e1134b4a4aa1afe07ff09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166841, "uuid": "05d4fc16-f4c7-44f4-99a2-a3342655a009", "comment": "Malware payload (NanoCore)", "value": "c4acad4cb7c203f10cabdebef4fa7c940af49ea894a1be9d8423867d5223698912bb066ebe34ab55f66199382a7ee1b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166841, "uuid": "c093ae53-6e4c-4435-90cc-a07a2f5bb7ce", "value": "T137351202BFC14972C5A31D365A35A721667CBA201F74CACF97D05A6CEE325C0DB31BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166841, "uuid": "be343206-67b8-4c5c-a1d9-ac6747372343", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166841, "uuid": "250c3d7d-edbe-414b-874f-609aff764843", "value": "24576:lTbBv5rUaUUUUUJUUUUUUJDgpvm6t2SwCDa8WZQ6k+5zUMexz:PBLUUUUUJUUUUUUFgpvqCDadqwFUM4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166841, "uuid": "5f78c147-c480-4f74-87c4-c62f11a120f0", "value": 1157959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166841, "uuid": "9a9a5379-83e8-4dbf-b382-70c60435c4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166841, "uuid": "265c2a2e-370e-4430-85b4-bea72df6e1c1", "value": "b6a93bf2bc23112c54ccb654fce93f27.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57a2c0f-cf06-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680186323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186323, "uuid": "92ddb55d-4b8c-4ce8-b560-c121740851c9", "comment": "Malware payload (RedLineStealer)", "value": "4320fffd20bf66e6eb74f2a1111cbe28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186323, "uuid": "21e9d3b8-63d8-4282-9619-fc3a45cca08a", "comment": "Malware payload (RedLineStealer)", "value": "a972d9e46c6bb59384ae8c522fdf36281dae6556155379af01807f6cf7563e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186323, "uuid": "9c93a979-1a4b-49fa-b288-049871080beb", "comment": "Malware payload (RedLineStealer)", "value": "75401c78bfe66efe02aa2fb11045353cc06fc906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186323, "uuid": "846a2bde-b5d5-4d76-bfcc-5468893cab95", "comment": "Malware payload (RedLineStealer)", "value": "84e8e75f988f4100c8d01624687dce5f869b45c160dcc5e4fe97a6814869fdbeaf8992d9a34c262a4a957edfbe80c35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186323, "uuid": "529c0294-a814-4e84-9b5d-73537baf7a2d", "value": "T12E246B029EFC7830E52357368F1EC7F8260EB8617E15BB9E16499A3FC9B43A1D261711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186323, "uuid": "0d256e45-296e-4cfb-b5a6-25b7de281bd6", "value": "9fa9386b668592c6b6f4c3793199047d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186323, "uuid": "7ef1a2fb-9aa7-451b-9405-fcd6ea67424f", "value": "3072:CTZATtRSZIXwafb1Xf9pMO9/C+yXk83KRA82nq4Py/6EURM6LqQ80:02Trn++ik8Tnq4PY6PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680186323, "uuid": "0290482f-6da6-43e3-938e-7ff654d0fb6e", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680186323, "uuid": "7cde5173-7311-44f0-93f8-48a562364a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186323, "uuid": "4dc78609-946d-4f65-986e-265b8f8f0551", "value": "4320fffd20bf66e6eb74f2a1111cbe28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadb26e5-ced9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Grandoreiro)", "timestamp": 1680167113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167113, "uuid": "89b92181-1afa-408a-bcab-f095d717cc60", "comment": "Malware payload (Grandoreiro)", "value": "9f370a4d78e168070152cd7a62c93ea0", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167113, "uuid": "9f501206-e0b5-4cd1-a3d4-5c2cc99d23d3", "comment": "Malware payload (Grandoreiro)", "value": "a9f9baa69dd0b15747c01aa676052b3de1f173f5da7928b8816a7c8779065358", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167113, "uuid": "3a7fa6b2-0298-4293-8054-000d56a55741", "comment": "Malware payload (Grandoreiro)", "value": "924a0fb8c3cfec12f34ef6f782bcd95734d36f15", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167113, "uuid": "a9736089-efa5-42b5-9352-3b50b0fc6721", "comment": "Malware payload (Grandoreiro)", "value": "526835a6f73b62c8791f637b155f3942f23f6be56fbf81254822ed922dad091d54988a502b870122d326b9087526a6b7", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167113, "uuid": "28992aa5-9023-4b88-8f4b-8657efc96892", "value": "T10A42F087BB47493AC07290899D27944EC7E0258B52248576BAECE4C73F7949CDFB1B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167113, "uuid": "92ac6593-9cf2-4014-b8cf-af42394558ac", "value": "384:50SN0S20S20S20S20S20SK1y0S20SCu+JK1Q:50SN0S20S20S20S20S20SAy0S20SCu+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167113, "uuid": "d84f327b-24ba-431b-bb6c-98adf811b674", "value": 12541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167113, "uuid": "63e4c32e-3176-4b26-9cea-472e7aa0fc99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167113, "uuid": "fff9e2a0-e374-4fef-865d-1acfbbae8022", "value": "03202329.arcvfile..695876870.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be2c66f-cf04-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680185422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185422, "uuid": "907d5665-91b7-44f8-a6e9-a6a74279fd34", "comment": "Malware payload (Amadey)", "value": "7a195e53e93148c0b87859c09c2e1f03", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185422, "uuid": "c02d011d-75e6-407e-80bb-e3686c3d4575", "comment": "Malware payload (Amadey)", "value": "aab77d378c5326618ae4c5fdd6ebcce721639dd2cd615666856ab76371f54c61", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185422, "uuid": "4d796676-01fd-4965-b0a6-11d0f13a8c49", "comment": "Malware payload (Amadey)", "value": "5a16bcf6aac147decb5d96360c0f0243070c24c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185422, "uuid": "1c624994-5bc1-4c19-b259-30ef88dd9d52", "comment": "Malware payload (Amadey)", "value": "8a504f02b972219ed07aba8ac614ea1b88d5fa34a27471ceb0e3adeebd9a7fdeb479e20e969fbe9bb21cd08cc4de1dec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185422, "uuid": "15467be4-7232-4bb5-8783-b20f7178125e", "value": "T11F252317B6FC5072E9B563B4D8F307831A367DE28DA885371749686A1DB3680B03237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185422, "uuid": "beef53a6-4128-4fa7-af59-9cb8eb49dcaa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185422, "uuid": "348635dc-c9e9-443f-89a5-6ade66065a4f", "value": "24576:Ty9VZXbCS43/gP+dvKCWi5aKJ8AVADGyMFg+q:m3ZrCEGB+CADn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185422, "uuid": "b2ee52ee-3d58-4be8-b8b0-5b477f999aab", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185422, "uuid": "8c40fd53-3608-4f78-adf6-4e390113507b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185422, "uuid": "f9ad6049-0092-44d0-bb99-8f550373794f", "value": "7a195e53e93148c0b87859c09c2e1f03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe982af-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680185126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185126, "uuid": "f395a930-a42c-41c3-9a21-49329a3e9859", "comment": "Malware payload (AgentTesla)", "value": "7b24c2a7b3c1ec900ed0a845a38e123d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185126, "uuid": "939c56e3-8ecf-4517-a52d-25ffb500d765", "comment": "Malware payload (AgentTesla)", "value": "aad777a2d2f4c889859ca2fbdc9d2bc782cf989c31d95be12abda966f4cbaf19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185126, "uuid": "2d8cca6a-9ac2-41c3-b6a0-8a3df3dca523", "comment": "Malware payload (AgentTesla)", "value": "a89235fac848e250412b1a965e2ecf572ad52fd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185126, "uuid": "46594ff6-8eeb-4b68-a1df-966b2a0025b3", "comment": "Malware payload (AgentTesla)", "value": "a0e628d8d8df3d2c4d711841c95234756a460d7a4516bb4ec8853c9eead9ae303ecf58659bcd3ec45031049fa08c3a33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185126, "uuid": "02f8ea69-7227-4575-9df9-470a9e320580", "value": "T16EE4F1142AEAE60CD035D37E96E1D1B067B9CCD5E662CB174FDEBCD3B38E2469421086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185126, "uuid": "ab9e2c72-f04c-42dd-8732-05bff9995424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185126, "uuid": "5fd39cac-e952-4e33-aedd-2c9b2d519fa0", "value": "12288:NvB3nmQRN7MPR0jPbomnUI55apZ6OLCUqYj9MhwmpHSzZ8ofCimOMt+:Np3nmQ7CIomnUI55wZPCUqYjuwWy98G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185126, "uuid": "83c0959d-da8d-4187-8307-29059817103c", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185126, "uuid": "d3a286e0-5c12-4abb-89a7-fc75dbd1c292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185126, "uuid": "d2eb9ff2-b5cc-4eb0-a55a-4f2d82bb0287", "value": "aad777a2d2f4c889859ca2fbdc9d2bc782cf989c31d95be12abda966f4cbaf19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5504cd5f-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165116, "uuid": "e464f88a-89c0-49f5-b0ba-ec80c032b2c8", "comment": "Malware payload (AgentTesla)", "value": "964e9a42dcbce4c5514ffa0cf0589ed6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165116, "uuid": "3cb24d11-c33e-4ff8-9cb6-121a34391bf1", "comment": "Malware payload (AgentTesla)", "value": "ab7968fb9a5e5c6a7d422f89024c5ff0e8a7bf5a08058bd64285de4fe1e1e764", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165116, "uuid": "582e5cc8-de24-45dc-8a53-66449444e481", "comment": "Malware payload (AgentTesla)", "value": "dc4099367529a70f56feea8ec93fb1b629b811c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165116, "uuid": "48e5df03-b455-41bc-90d4-5984de182b0d", "comment": "Malware payload (AgentTesla)", "value": "5d1f1bb40f4bfc9a07a6d6bf431c8ef7c66938ce3c67e3059c85bf693da2cd642ba05a358136ed10785d33a75eabf12d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165116, "uuid": "3f08fe6a-f402-4bbf-8fbd-eae4d1870069", "value": "T16855492439FA501AB173EFAA4BE879DADA6FB7733B07645D1090038A4723941DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165116, "uuid": "cffe82b8-e072-4473-9353-204edb56c933", "value": "12288:9h1TmZyKFkC15DZ193x9BZUy6kY4F87Ee20An1uELmVUUZ/hL8yFffCJyC5ythoD:TCxCU2CX5lUeRzxbT0bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165116, "uuid": "18d66a51-26de-4e98-ab11-1a28f78a95a5", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165116, "uuid": "c4f46924-5929-49eb-81b0-3e91dc89588b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165116, "uuid": "7820d7cc-ff00-4eef-a3c5-612fe4681f71", "value": "NETES REQUEST FOR OFFER HURK75BSil E10623032023_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1cfae4-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680200907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200907, "uuid": "60694109-0099-4460-9aa2-b1bc162a1468", "comment": "Malware payload", "value": "8b41762ba6f5e51ec3960b2b5a87ef2c", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200907, "uuid": "25a00d6c-d3c4-4636-bf6e-36ac353930b4", "comment": "Malware payload", "value": "ab7c1967bf1fefdffde93626b78eb30994655ab02f59e0adb0935e3e599a953f", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200907, "uuid": "8495bb46-2dac-4923-99ff-97ed77dbc814", "comment": "Malware payload", "value": "3f4925d4dae214db46aa61cf868a32cf88f64e10", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200907, "uuid": "3a8fb514-86ea-4a24-b0a1-c4f0217db086", "comment": "Malware payload", "value": "6dcdb9ec3174cf69bdb8eb268ca54721c4ee077568339a59f5df39c2f6000d61d13944d0cf6e0fbed2b789400954c987", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200907, "uuid": "8a08f68a-7a31-4308-9952-fc159fe8154a", "value": "T159E476F0BE01D881E17D5F6AF3ED7908A1343227EADD9A4600A466591EF7A01FD1ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200907, "uuid": "830d606b-4c57-499a-8550-dc61e222bb25", "value": "6144:lHlnTWI4lCf88RUf4Ta8YWq16RYYy4VSmadyjcPB+F0OvZ9W:lFlffX2f4Ta8YWqwRY8we0Oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200907, "uuid": "c86408f0-4c0a-4243-843c-59c6e056632f", "value": 690450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200907, "uuid": "4329b53b-24a9-46b4-b0f1-394b7209e341", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200907, "uuid": "bf8c9661-0c3d-4749-8e7f-36ad8065621b", "value": "SecuriteInfo.com.JS.Trojan.Cryxos.4635.10278.20442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdbac52-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680161210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161210, "uuid": "45edd2b7-51e3-4863-9d4c-05751289e58d", "comment": "Malware payload (RemcosRAT)", "value": "165edf06d69214e94e16b9ec56b0ffa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161210, "uuid": "cc08af93-f34b-420d-9fd1-a5633bd8fc77", "comment": "Malware payload (RemcosRAT)", "value": "acdead749ad0efa2a07733904a8c37c75d94db2d2fadf2b22a5dee38499b40f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161210, "uuid": "b4c564e1-0521-4f2e-9446-d9ddafa59cd3", "comment": "Malware payload (RemcosRAT)", "value": "ccd76f130e0a1f1d792b24b60d2171db2d9f3b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161210, "uuid": "a5ee1b90-4bba-4a09-94c0-049d37ec7287", "comment": "Malware payload (RemcosRAT)", "value": "0922ca6f6260906b7ff610d716469417753d01868d2bde1a435ac6a84eacad73a28822d38a3be2c13bf1edbe4764d02b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161210, "uuid": "07a619d7-a4ed-4fd5-aa62-7338503bc6b5", "value": "T12D25125432DDC529C629463D82E4C6B15379DCC0FA79CBA21FCABC8B73CA64A8536192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161210, "uuid": "ba706690-f2a4-49ac-aed1-e221eab2ab1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161210, "uuid": "d52ca4da-e197-439b-90e3-697e46ed6d54", "value": "24576:Pv5hzaiQ4j91uTjEs8NR+tQmKOpNzpBjihpS5a8bimX:PvHaJC3uTj/8NAWmKOF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161210, "uuid": "7513092e-55b1-4d56-9ae0-894867e16e8c", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161210, "uuid": "f5bf5c70-5f97-4811-bd06-e537a3e24c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161210, "uuid": "b739b91c-7bfb-436c-8e41-ba72f7f79eea", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b3d80a-cf2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680202541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202541, "uuid": "7ff7430e-34ff-47b0-8ebc-73cc373aadfe", "comment": "Malware payload (DCRat)", "value": "6b288b20a06a4842d0c871d9fb039657", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202541, "uuid": "257de689-9abb-4319-af13-669de10ef1f7", "comment": "Malware payload (DCRat)", "value": "ad88cb3677f4c3954d08c5f1d6d3635d07f31c36b9c11a609993c905f7f9eb3e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202541, "uuid": "8e5324cd-1908-4874-99bb-e9ced0a52630", "comment": "Malware payload (DCRat)", "value": "dd7f56f49cd5b47a03da59ed7bf725448be7bed7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202541, "uuid": "8025fb9f-4ac6-4ef7-b181-bf56dec63469", "comment": "Malware payload (DCRat)", "value": "2cddb8d04ce111905c3cd6b97029e2c63693efe363c70883b39472beed5d0c7dbbab7e8691f70bfc5e9bb55a93613952", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202541, "uuid": "2d6ecb71-4cb8-44e5-a895-e0f088147376", "value": "T1E5733CD927D8C62AE37EBB30E4F011258936F94279B2EB5F5E40409D1C23BC0A65677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202541, "uuid": "7eeca479-7708-41d3-bc1b-fe1b0d0dca56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202541, "uuid": "747af4e9-391d-4ffe-8058-12772112ae0b", "value": "1536:XIp6Z4Zo2+xAqXynxL7d9fN44uARZAjBp7J8RRRRRBZZRNOf0EReh0RrZZZZZRd1:Xj4Zpl9fkARZAjBp7J8RRRRRBZZRNOff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680202541, "uuid": "967fa8db-a27c-46e2-9aca-f6678380b140", "value": 73928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680202541, "uuid": "6bde723d-af05-4ff3-b4f7-b502fdf9999d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202541, "uuid": "f1affae0-1d43-4331-82a2-84d930f1ab94", "value": "6b288b20a06a4842d0c871d9fb039657.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb8c251-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680198284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198284, "uuid": "4d8657fa-c99c-4063-b677-04d5c5beaebf", "comment": "Malware payload", "value": "d0cd85f20c79653560300297685bfb7e", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198284, "uuid": "41314bcb-ecdd-4082-8526-def05019f04d", "comment": "Malware payload", "value": "adc253b77c0887d3a8ef4d66d99d66fb0b8824bfde4bb13538e881d47aa86883", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198284, "uuid": "eac3ad2c-cb5e-4d8e-926d-5ad5457ae01b", "comment": "Malware payload", "value": "fdcf51fea7bcaf1a6cc1cf0c90a8a1e04e2e9fd8", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198284, "uuid": "517a9ac7-5ef8-4254-882c-50ecc1e7e702", "comment": "Malware payload", "value": "ca2163985e6bd9ac53ce6f6dd927ddcf94f2c64e643c86e9e4dac416c318f92c11147c7e5d29c40d58def2d4460fbd33", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198284, "uuid": "94678d1c-0a8d-44b6-87f7-c55163d56077", "value": "T170C4AE57F6E77A65E6AFC1BAC6B1C92D66B3309602B0C3CE774055492D22392483DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198284, "uuid": "f4007c6c-7cb8-4558-8a3a-710d4ff00f0e", "value": "f20a8db3e4a8c03c1ab177b2660fdd78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198284, "uuid": "f8a33a85-a63e-4f75-a5cf-fe8152791007", "value": "12288:czLjlZHAt+AZrkOCH8bzbBSrevOi1uWD242S6+4:czLhltAdkjcX1GDWeS6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198284, "uuid": "e26af792-9e07-495d-82da-14eed18e04d0", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198284, "uuid": "947630e9-3866-4f3b-9f5e-f916f3449573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198284, "uuid": "15b09172-4704-4929-aa79-894f4be13ae9", "value": "TAX Return 2022 & payroll.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cede0cd-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680158258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158258, "uuid": "e91ca497-84c9-4600-a2dd-3583dc913193", "comment": "Malware payload", "value": "5f2534cabe1ca9b4f40fc721f9b0ce73", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158258, "uuid": "2424f052-7c94-4e99-b2ae-b42072c0f063", "comment": "Malware payload", "value": "ae3ef1db4c574f10dc66e5ce5f5e8048aaf6fc5cc6257880e256a8a467f3d8ad", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158258, "uuid": "df39c1e6-a167-4813-b4cb-68e2b81b6ecc", "comment": "Malware payload", "value": "0f190acc660ba60352f9cc1fb0c5b39863954d1f", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158258, "uuid": "31bc4dc6-bab6-49f4-ab3b-822d2cbba117", "comment": "Malware payload", "value": "e48064318f564a7dc826526ecc6af1b8c2ac721c405f5915cb0c2deebe87a3116e46997deaad6d17e512e749dcf8d23c", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158258, "uuid": "b48cbab4-c454-4a94-9131-34808d7d751a", "value": "T1DE7423008BB3851F8634A779A46F1BCDFF0587A7401606DDB2BCA17D1FDEAC1526E898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158258, "uuid": "2c3a5f30-e248-4d6e-8214-46085c556aa3", "value": "6144:76XqfxJBtatevHpPEdVdrEP/h+2U/TcBhIBJM95mSpIV8BAOVU:7NxJ3atex2VdrERa/IMBJMuKIV8eOVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158258, "uuid": "d01935ba-3e8f-4382-8e94-2772ec696926", "value": 353775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158258, "uuid": "bf76eec0-ad76-41cb-9ef2-8be4664ae658", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158258, "uuid": "de7c2e7b-8b34-41ba-a1e3-219e0c3dd475", "value": "RFQV21019612.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c18252-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680196894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196894, "uuid": "2f04777a-9969-4fed-bcd3-8168b3b920a7", "comment": "Malware payload (Socelars)", "value": "2644502236f017d4c97825b0d24fc434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196894, "uuid": "9c43e88f-c213-4890-b382-f4c1b6fb1cd7", "comment": "Malware payload (Socelars)", "value": "aede6ea2d498e8a16c17483e53eba59866f01cb1d468ee96067042d037a6010a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196894, "uuid": "7cfcc05f-a34f-4f90-8198-e150c01586db", "comment": "Malware payload (Socelars)", "value": "f18ac07f033922a89126c1ce424858a75ee17401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196894, "uuid": "865abad0-6fc7-4937-800c-00ee04167645", "comment": "Malware payload (Socelars)", "value": "7c95ff3a3d4ca6bd49b8da35e4134ffd19f04fd6a1fa84e3e8838a2338bdef30653ea107c3e19fad1622b3327d548ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196894, "uuid": "4f017ab8-7265-4a65-948c-fd857c6fffd3", "value": "T1A3658D21F7C26032E8E310B785FF56BE9D3C6A114708A4D7D3C81D999B614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196894, "uuid": "b65d87fb-27f1-4164-b702-c6cbf30b66d3", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196894, "uuid": "a8ae2c34-1979-4fa1-acfa-f03f89271ce8", "value": "24576:BVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrEXR5h8tmW:vpJOl8xFMRy/SeQgB5OwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196894, "uuid": "1a0bab2e-a506-4c6a-b963-514c896d68ac", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196894, "uuid": "b6f11643-29be-47b1-967b-f0cf9730e123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196894, "uuid": "82d421bd-1d0d-4370-8082-1adefb2764dd", "value": "2644502236f017d4c97825b0d24fc434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec10a2cc-ced7-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680166229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166229, "uuid": "fb222521-04b7-471b-8088-eb6dfbd11f1d", "comment": "Malware payload (njrat)", "value": "01526076dcc85fa1f04b9799d9822a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166229, "uuid": "3b04ac67-75fe-4098-8511-39d5ffecebd9", "comment": "Malware payload (njrat)", "value": "aee784ca18718d027f2381262caeb491a49a62e1ee5563753eede4b742a4923b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166229, "uuid": "64854db9-0d5a-41f7-87f6-f85f9c31c7f5", "comment": "Malware payload (njrat)", "value": "03329cdc6f4122cda4b126158b46a7ddebaf0aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166229, "uuid": "84d9c1ef-b881-42ed-b9a8-ea4b8430475d", "comment": "Malware payload (njrat)", "value": "25779393bde3539607a82c27ee1379d6b7ba8996351f35a1527fdaddaea2fbed15e8fe6eecdf6ba3d11e6b5c2b5d25e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166229, "uuid": "0abb5238-e05a-4665-a4fc-c99810a19a6f", "value": "T1F65481C4F26CFDD4D4FC10F2F81694E13AA83C6AE89064CB2EE77E2B3D721A65246515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166229, "uuid": "520fc854-9958-4ee5-ac4d-c1eb8111f8e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166229, "uuid": "73b144c9-0a60-4984-ae44-8fa605199711", "value": "3072:Tv+a8MtZ+yJAkETtnNNKb6HJNgMoJlQyA+oo:z+a8MO0WHJNxoJl+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166229, "uuid": "ee24d85f-c319-4449-b18c-553e1191dca0", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166229, "uuid": "8bc27330-e18c-4992-8e04-577d1cc1c0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166229, "uuid": "aedbd849-1b56-4033-a642-d0cd9c75907b", "value": "01526076dcc85fa1f04b9799d9822a2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d405f48-cee1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680170365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170365, "uuid": "2205ff41-817e-4c08-8d98-41521a35401a", "comment": "Malware payload (Stealc)", "value": "f692ba2f06be98acbb517537d9fa9585", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170365, "uuid": "d27633df-4ed4-4202-a967-5a7f6aa49b47", "comment": "Malware payload (Stealc)", "value": "b03a49e4d7224804379ff6281c5edcc49f89e2cdcb6f74db2224c415e7dff2fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170365, "uuid": "df2f50a8-0a42-4d2c-9198-c542331ca1d4", "comment": "Malware payload (Stealc)", "value": "bd9dcc56afe7570aeaff66083e5d7a71fedf091e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170365, "uuid": "91beff34-9382-4ddc-a6e0-0d08b316abb4", "comment": "Malware payload (Stealc)", "value": "c7ca557783c37366d414c8e4840a26e4cfd88075efdf85e7b25d149fe959d56c3986d7b6684381399a2c1862addf6e2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170365, "uuid": "98671f2f-d58a-4055-8ec1-61347b5903f7", "value": "T17A346C069FFC7830E52346368F1EC3F82A1FB8617E55BA9E16595A2FC5B03B1D262311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170365, "uuid": "8d0e5ac2-37fd-4055-9e33-dee35667cd8b", "value": "be8fda35a838774ccca2fa79eb32032a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170365, "uuid": "ab0c8a6c-c1c3-41e4-8c33-21037cfe8f99", "value": "3072:sHUB5K2MriDTyYZYr1qWXvZx8BggJzFkNBfOWp80+7hfh80:WoXk8JY18zFkmWC0Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170365, "uuid": "bf34b7b2-c2ef-4c42-9fc0-a359f9c8bdce", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170365, "uuid": "4a7d3313-793b-438a-a0c8-431f98764cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170365, "uuid": "e3bd5d41-ff5a-4626-a2b6-a754229fd754", "value": "f692ba2f06be98acbb517537d9fa9585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadbc689-cf11-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680191138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191138, "uuid": "f08ff272-2a2e-4f6b-8bda-4499ee6afdef", "comment": "Malware payload", "value": "59569025dfa7f0a1f157caa6e5520f6f", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191138, "uuid": "3807bfb1-d9b6-4f9f-9d99-429c9fc838a4", "comment": "Malware payload", "value": "b0f435ec98658833f712ba5a53aee42e1b5c06c85ae07723d79457e87fd011e6", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191138, "uuid": "e7ed4544-f89d-4bab-a69e-4d6b2a60ffde", "comment": "Malware payload", "value": "649cb9d078d60a7ef5d600cb9d86ade748a912a3", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191138, "uuid": "30808f1d-6722-4140-b3b9-6bb8a06a271d", "comment": "Malware payload", "value": "cdebdc78f98e17e5d0c7bc61b165e0b3eb92efb884aae4cd7e37b9d4ea20a759a3e8174b2856abca4614121442440027", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191138, "uuid": "d5262b2e-dea7-49f0-8068-0b1bb39ca3b2", "value": "T13951971AF847D15C9F79236BEC978A62FF1B401B9EA2104C71DCD2495F30809A66CF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191138, "uuid": "4baefcb4-2aea-49ac-8d09-d70cd1dc7ecc", "value": "48:hxChX48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBoy:ChFGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680191138, "uuid": "55c24696-473d-4531-951c-379329b142ad", "value": 3130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680191138, "uuid": "03f8f298-83a9-4e07-b913-9214d69831b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191138, "uuid": "f759024d-7201-4659-af53-ed6ee04f6e1b", "value": "pqiek5MK.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114a2cbe-ce93-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680136656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136656, "uuid": "b17e89f8-003e-4628-b04d-791c3512473d", "comment": "Malware payload (TeamBot)", "value": "e023ee706cf7e6d3f9fe870353148182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136656, "uuid": "d7398ffb-fba3-4c9c-bfd3-10d689730623", "comment": "Malware payload (TeamBot)", "value": "b14562b8c3d16c3ab7700f11abfa158b0b080eda1b3d2dbf823d295be710ff22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136656, "uuid": "02af92fc-db83-456b-b951-bb5273879d82", "comment": "Malware payload (TeamBot)", "value": "ed8df69d77fb4ca4fd4baff1d3367b58fa2cc60a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136656, "uuid": "e29d5efd-c12c-47f0-978c-e92f1da4e9af", "comment": "Malware payload (TeamBot)", "value": "cde1f73421a13aecdb5f19988129a86d03a5acacf783ed2a4937accb5e2ad5a1f9d0c482cbd4542fdeff1854f4a97584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136656, "uuid": "1055f6eb-998b-4557-827e-d2d8159f6127", "value": "T16A44D0227791C472E95B0D794801EA78DA3BBC714B218ACB37D40ABE5E717D28F36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136656, "uuid": "41a2cb61-3eff-4cd2-b510-7d676bdf86c1", "value": "2222fbb8197512ba6814617787ba14f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136656, "uuid": "71518aeb-afbc-4c2b-84f8-8a5698fbb0d8", "value": "6144:0xxlc2CYw9MwaL56Qwfa4LQUE59kSjAMJeK:Slc3Yw9MwaV6QMbQdvheK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136656, "uuid": "d5206917-3fa0-4779-8660-7f84071cfac6", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136656, "uuid": "2dc35da5-f7d3-4bc8-8ec9-ad801b9f1fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136656, "uuid": "13d0b20a-0bf8-42bd-abd4-ee3a017cfc3d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a910ef-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680196982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196982, "uuid": "bf07259f-485b-4c83-b3a0-e85416fc8e09", "comment": "Malware payload (zgRAT)", "value": "8f849a213ec3fe21f7a52a685c4bc071", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196982, "uuid": "0f22d6cc-55cc-472c-a772-f98819703d16", "comment": "Malware payload (zgRAT)", "value": "b35ba36604a607f0e835bcb456d8c8a316ee43b70e828cdf46bd500a363fa19f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196982, "uuid": "b7663149-ec4a-43d6-98ed-41d48e456c29", "comment": "Malware payload (zgRAT)", "value": "9aebdb6138f0f97f8957948f4411e0ea63c7c24d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196982, "uuid": "8f4f90ed-511f-4583-8a86-e3c83b778a83", "comment": "Malware payload (zgRAT)", "value": "ac53b71fc927a8cf9090938d87be1d0ed4646c82a1fc57f0591bc7613b4f13542a4d8908f2b59fb9d363d727959c9e24", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196982, "uuid": "c77a33a6-a815-48dc-a448-9405b64e6f80", "value": "T114251213E7448E4BC80287B8AFA769C9530F7E413A9AB58721043B1F7E76A72F54325D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196982, "uuid": "066868ff-b4b6-4bc7-9ca9-ffa4643939a2", "value": "12288:l3aFiKXKk1Arko7aqUu9VneKArcqUu9VnesZuqUu9VneQbc+M+uUWq6KE8YNtirK:0LKOu9Vlu9Vgu9Vs+MXUIyrcD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196982, "uuid": "3fe6fbb8-e578-4a5f-a4b5-55ce8f53773f", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196982, "uuid": "18a4cb83-34f4-4a30-8ac6-77d269c29eeb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196982, "uuid": "5ae34c39-ab48-4832-9341-80494d2946b8", "value": "Order List 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d764a8-cf23-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680198665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198665, "uuid": "9181ffed-83e2-4f21-8b7f-a0381bb26f16", "comment": "Malware payload", "value": "6b66500535ca8249b24dee74ed55e85a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198665, "uuid": "bf3e04ba-df43-40f9-aa5d-a09d5a3ea9ce", "comment": "Malware payload", "value": "b38523303ba40fefc42252fcc108669a243074e0c3b8828cfb46c733775a5872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198665, "uuid": "a43f4ac0-4a55-4d50-9969-b22bc0165419", "comment": "Malware payload", "value": "f4185a8a0701037dd83f66894105e81415be6db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198665, "uuid": "5774d8b4-a763-4e66-9664-67cbf387c957", "comment": "Malware payload", "value": "5442c0301f1e4127eed813a93829f29df6b709a0bbd2cdcb2e5dcdf061467d2a112300640d81af71fe1d9b24b416e2c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198665, "uuid": "eb51fab6-eed0-446c-ad01-f08183af8843", "value": "T162B533AA2C696D44F456FC7C94209B221F2DC239CC79DB5E3589A011FDE7EA364863C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198665, "uuid": "da1bb2e2-ec35-4f54-bba4-ad51357054b7", "value": "49152:FjeKUyNL/dgCNkoVsemmIQ/RCLxnnLFeMtpzdIbzDO:nUyJF2oYGCLxnJ7rzdIzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198665, "uuid": "71cf8568-01a6-4c14-9546-0c3dc9a17eed", "value": 2391759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198665, "uuid": "0dc70090-ecb1-418c-8c5b-f8e46531b872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198665, "uuid": "37516b2a-e74d-4ca2-ba0d-fbc449e6442f", "value": "6b66500535ca8249b24dee74ed55e85a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d437be15-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680161464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161464, "uuid": "9b913f22-6667-46d2-ba10-614fffc0e741", "comment": "Malware payload (EternityStealer)", "value": "147ad1d364de0cb20780ec01509a4573", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161464, "uuid": "64954ff2-290b-4434-a9c7-a06c8cebc49a", "comment": "Malware payload (EternityStealer)", "value": "b3b2dc3be1936fdb02be2e420f7264bbe124f8e98e4c9a52b4793106bb283f73", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161464, "uuid": "85e6253c-2331-4327-baf8-700373d98219", "comment": "Malware payload (EternityStealer)", "value": "00f69c974a1ee9282238d81576f762aa43964264", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161464, "uuid": "20de9ec8-720e-4758-b45b-94a97feaf374", "comment": "Malware payload (EternityStealer)", "value": "85251fc1cffb7dfcb63c37cdcfe44625f54c107ae7dfe271336dc48cc6f903574ba5ee6e7c778575de80b694f920ab53", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161464, "uuid": "2db6ae3b-0605-49db-bcd6-9c90043fa8c2", "value": "T164A5F17C1BECC656E439D7758BF44C30E7EDB5176A32CD1E79EA00850A26A42768332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161464, "uuid": "746e8529-8437-48bb-8ead-605427c48e26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161464, "uuid": "c5373604-846d-479c-a06e-16fc73ca21d4", "value": "49152:QxIOW8Fe6O7/KYyOsNCfR3ZAKr1KZvzHrqHyVPsoHu:IIEFe7zNsIJHQRz2AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161464, "uuid": "4e0730e4-cc8e-49cd-b047-9f1d50af0d2f", "value": 2092032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161464, "uuid": "e5a1a15d-4d37-4774-9f8f-0db4192ae725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161464, "uuid": "97e62c40-dd0f-4cf6-ac98-0ce5f00fb982", "value": "147ad1d364de0cb20780ec01509a4573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dff0766-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196834, "uuid": "5a868a8d-03d6-4d78-9ad3-ca98f473d3d7", "comment": "Malware payload (SnakeKeylogger)", "value": "865111ce98f7f62c724cb6ab2b0a8b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196834, "uuid": "5f8dfd76-d452-4cea-8bf4-2abdf0b1ef6d", "comment": "Malware payload (SnakeKeylogger)", "value": "b3ef6a767f98d2e81a8761a794096f44942de8897d4f4565cb23da396140f0a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196834, "uuid": "a05d2889-15ec-4271-8d53-93bf942215b7", "comment": "Malware payload (SnakeKeylogger)", "value": "162fb8b25e35784cae60ed263306dc2af745817c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196834, "uuid": "b2249578-1205-4d00-ae8f-94b9a4f24925", "comment": "Malware payload (SnakeKeylogger)", "value": "db0efcb12929c8d73bc68489e850f4cc0c5a36da8c9f43479b281ea2eff5440a1b86c6fe0a438077c7a56b17d73988ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196834, "uuid": "96011775-2588-43ed-8b38-05d0f30006b7", "value": "T12BD4F11839E9910AC019C7BEC5E0D2B067B9CCD9E962C3234FD9BCE3B3DB3559965182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196834, "uuid": "57d4578a-e47c-4f57-84c8-d1b719de1a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196834, "uuid": "f5e4aceb-a143-46fa-85b2-949434048ee5", "value": "12288:d+DjF/gL63xqCI6tJU7fqTL/wh3jrj9z6IXuF/SimOMt+q:d+iexRIyJUTKL/whggbimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196834, "uuid": "b3839391-d924-42a2-969a-5893ffad2715", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196834, "uuid": "74ab2f37-40f3-4418-aaff-93177a856a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196834, "uuid": "def8d8c7-9a10-4c4d-b25b-bb9dad99dc1b", "value": "JuwUZxtNUSSbLrf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d343bba7-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GurcuStealer)", "timestamp": 1680159315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159315, "uuid": "869c87fa-8fa4-4e4b-af8a-7183ee7ada28", "comment": "Malware payload (GurcuStealer)", "value": "5aa405d35131a36ce1647c6937d3e529", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159315, "uuid": "155ed882-e9a3-496f-b8ab-bf81f1b05102", "comment": "Malware payload (GurcuStealer)", "value": "b47f96ba63f6861ef3d07ef0bc62d99ce4bd809c79a3121cc3ed18bee2a51358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159315, "uuid": "c71d9f2c-f8fe-42e6-8858-4e146de1a47f", "comment": "Malware payload (GurcuStealer)", "value": "aaa19a9fa3652a1d39509aac28d3db7b95d276a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159315, "uuid": "9ff2090f-f1e3-4f5f-a884-ecde6355e380", "comment": "Malware payload (GurcuStealer)", "value": "4baaa121b91324b70e0279181fee05817ef478136ea29dc17b79a39b68e86baaa41a98ee230d21102533b942ceda209d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159315, "uuid": "0cfa564e-7430-407f-bfc2-37dec62f42cf", "value": "T1FBF2E85573E8C736E0A84B36D9B257004BB4D7436B06DB0D6DCE619C1EC37C96283AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159315, "uuid": "dd577a81-bc5d-48fe-9dfb-914cd9d392ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159315, "uuid": "882dd681-d8d8-46fa-bcdb-1dade7dcb73b", "value": "768:wtJHrFZuGtbhPAbCFRbPuJHHpXlKm/oAT1wdhMSWgU:wtJLFZuAbUcbPgHpXlKmgAT1wdh3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159315, "uuid": "3e0588ad-67e9-4261-a443-b01e81f9f624", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159315, "uuid": "30660ebd-5fd9-447e-8cb6-65fdd8d5390a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159315, "uuid": "37df00fd-f248-4e8d-b4c5-eb5dcd7fb092", "value": "5aa405d35131a36ce1647c6937d3e529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df3f78a-cebc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680154421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680154421, "uuid": "a43caa0c-4108-4b6c-ae8e-28860fdc7d80", "comment": "Malware payload", "value": "a45212aad1506c8c13a375b5cde44064", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680154421, "uuid": "911c44b4-1a67-4f9b-ac96-5cc2a2389a75", "comment": "Malware payload", "value": "b4814c8db16ecdd7904e81186715bf2a4b4ba28ef5853a41a8f59824f47f8f24", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680154421, "uuid": "144e6ffc-f45b-4c0a-bb0f-c7e12e7daf5d", "comment": "Malware payload", "value": "dbcdbdf927e351d371606e861cee41bbd2be1d33", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680154421, "uuid": "94ac7a9c-ca4a-4928-8423-d2f530d1b524", "comment": "Malware payload", "value": "fdd09d8a4d608f056db5bca2a4bf7edde4e76edbb3816ccaa2d6c98b08c2d19ee460e816bfbcd5606db55705df4ca713", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680154421, "uuid": "f84c13e2-c0ee-4432-a85c-162ac455bc5f", "value": "T1BEB43B2C28CCBD70E9ABAFF5824F9869052A62212513DC33116D47DC5EA9BED8753C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680154421, "uuid": "e5bae64f-29b6-4736-a00b-208cad24a60b", "value": "12288:2pYAPj8P12mm418XSbMgwAV1zVdUfW0SCTDa:gwP4tq11pCWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680154421, "uuid": "53f3dc77-affe-43d7-a907-a23b1c4ef01b", "value": 496568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680154421, "uuid": "1ed893ff-2d7f-4b81-8f9a-154637e564d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680154421, "uuid": "53763c60-e7ab-4588-bd67-7bcf57a2c4d2", "value": "B0A4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff604d3-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680198313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198313, "uuid": "8e1a6b77-2e33-4a9c-b88a-a08f2f1f74a4", "comment": "Malware payload (Loki)", "value": "c3a97565b05fae2c36ecd398ab137389", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198313, "uuid": "30f3ebca-8b3f-45d1-a7a6-d39f53b1a2b3", "comment": "Malware payload (Loki)", "value": "b56a903dfdf14906fd90789b61fd94b7b6c657c436759d192cc32b5d77f8f2f9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198313, "uuid": "813b6202-dc3a-4a30-9c6c-7e9c5cb92078", "comment": "Malware payload (Loki)", "value": "91b0fcf7ed1552a4c3bf1b234646cf6d0186e9ee", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198313, "uuid": "c8adef0b-c091-494a-8672-4e177e38a78e", "comment": "Malware payload (Loki)", "value": "dcf3ebb8bb8383e44cab1acb745f51687f9269c445a48029a49a8f1a2c222f33fc45cba16651b7f92cff8dd3a42686ed", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198313, "uuid": "8d3e0674-5a93-4036-a8a7-a8f57b9d931a", "value": "T13F746F80B5EA1004A2D1A9438FD7FA6D8FB7F5DE98385E3988CC094F27DF5A148127D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198313, "uuid": "c02f6ce8-5188-4a44-b6a5-961b10c504cc", "value": "1536:j89r/aDcWJwG0mtvR/Eg5GKFV6UtbOc8GxqsMzcCq:KtZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198313, "uuid": "64d2f28f-c223-4d66-ac84-be76b6266b87", "value": 348128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198313, "uuid": "6f554d4d-0a59-4d55-9e8e-86d8ff28baf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198313, "uuid": "d89486b0-d0bc-48d2-b584-a4085118fbb8", "value": "Fatura PI0865446.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5683cf54-cf08-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680187023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187023, "uuid": "1ef5c9f3-9c10-4764-ad64-d7e0c5f6e9a5", "comment": "Malware payload (CoinMiner)", "value": "2ad612921934ed0afd281ac0c3d89598", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187023, "uuid": "e9eb96a2-234d-4b8f-b1f9-4eb5bc23ebff", "comment": "Malware payload (CoinMiner)", "value": "b5d5be601398f8adcad9083ee4f1145e383d22e8a8aab7c8e8e5d059b629beb2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187023, "uuid": "0cb744d3-8a51-481e-a1bb-565c05cd5e9d", "comment": "Malware payload (CoinMiner)", "value": "f7c06c8697b441cc8f08cebb1b26631fa6c97e8a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187023, "uuid": "ff8fcc9a-d468-44a3-b219-2f33226928d6", "comment": "Malware payload (CoinMiner)", "value": "8c8097f3fb61e113827f04e8faa78619b79e82696c8186ddf911032c42a14d88742b99c7997e9344c40ff112cc7e6794", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187023, "uuid": "4638552b-3437-4859-86f4-0679a54172c0", "value": "T1F744CE37A4459276E8DBC0F948BEA6D3653E787033D240C32BD80C561966FE6EAB4347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187023, "uuid": "828a242d-f925-4d54-999c-33e00de9b604", "value": "303b4a863d3cdfccef2b33459673ef8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187023, "uuid": "0fa57e67-ac4e-495b-a8d7-b9a35c66214e", "value": "6144:5+IjNIIRkP9HRNyD/NRxgdg5UwCYoAhLobHvHkxhfA:5ZjtRkPrNe/9r2wCFAhcbHvHKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680187023, "uuid": "52feb91b-0498-41ab-9669-54c451646aa2", "value": 265992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680187023, "uuid": "b7b975d8-78ba-43c7-b586-df9eb1daa7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187023, "uuid": "5f6f538f-fa8a-40f9-9217-e735c2f86d0e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d74d312-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680158742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158742, "uuid": "e0146328-2961-44f6-a15c-8b598b02799a", "comment": "Malware payload (Amadey)", "value": "4310b47263ae111e29edc82998946a76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158742, "uuid": "5a9681e3-d2f5-45cd-adb4-a673f3be0d1c", "comment": "Malware payload (Amadey)", "value": "b6fda6360a3e845581ea920eee0db71177b0073aa290ac9a241ad7d1943257df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158742, "uuid": "00c07468-7b34-402c-8ca7-df9721ea7d3d", "comment": "Malware payload (Amadey)", "value": "5030f331416eb1c52dbcd32c40b0b43901eb180c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158742, "uuid": "f9184135-ee35-4328-ad2f-567e8b0ceba2", "comment": "Malware payload (Amadey)", "value": "4fff53004fbc1e6b4ad4d4192feb59353c266c079720aba757eb56251e14589475a397495ad19a777098e83dfbcf833c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158742, "uuid": "5bc0d0f5-9cfe-414d-85f4-bc566187e30b", "value": "T19F25231396DC9072DEB6877068F206C70A3AFD62487893AF6559B80A0CF3B967571337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158742, "uuid": "0b3ddcc7-8b22-4407-a8b8-201a1d316a49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158742, "uuid": "2b2fff0f-d77e-4bf7-925e-f0e9bcb764f1", "value": "12288:lMrcy905IjXpGZ987bERMYGdT1c0j0jt8QblW9yXTrnwk51rN732C9XhAALxSwDG:dygIjY987GMYs12t/5DrRFmcXhAKSUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158742, "uuid": "0682686c-adc4-4d03-9f36-47bef760a5e5", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158742, "uuid": "ebf9289c-8596-4336-91a7-ed338f8fb064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158742, "uuid": "7afe2927-ac55-434c-a24c-1a51c30431ed", "value": "4310b47263ae111e29edc82998946a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32ba35e-cf08-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680187232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187232, "uuid": "89ae1326-092a-48f0-a1b5-154fa65b03b4", "comment": "Malware payload (Rhadamanthys)", "value": "1b56ba80ed97b7c748e41e03bcf0fd61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187232, "uuid": "ac39e7e3-fbd1-4d36-8e60-0edfe54b384e", "comment": "Malware payload (Rhadamanthys)", "value": "b702711a949a596fff343b6cfbaee3c0600e0e7feb2cf1bba8b663b926c94cf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187232, "uuid": "fc713045-4f6e-48dd-9a0e-f65960f71cb7", "comment": "Malware payload (Rhadamanthys)", "value": "40fec612b50421a655390d21d672821f489c6576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187232, "uuid": "d5cb480b-de79-4331-bbb9-e6ec0f9f17fe", "comment": "Malware payload (Rhadamanthys)", "value": "18c7f11745558bcd9828b57ecf9652f949dab66160f645afaf578312f3ddc0c5f6e8c8084a7f6cb9202596082d1526fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187232, "uuid": "05877b3a-b047-401b-96c3-4ee23a5a20fa", "value": "T1BE549E069EFD7870F62346368F1EC3F42A1EB4A27E15FB5E16455A6FC5B03A2D222311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187232, "uuid": "a66874b5-e4c5-40a8-94f9-b1cd49943143", "value": "9fa9386b668592c6b6f4c3793199047d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187232, "uuid": "6f94d211-c991-41ce-bff2-42e1121ab0e9", "value": "6144:cm5Za9waIPw55lJ3yWAaNBA3p3sjYh0N+nZCXzKe:c0Zlhw55bSaM3tWYhKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680187232, "uuid": "b6995d2e-ec0b-4e2c-b41e-5183a5064246", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680187232, "uuid": "7b72857e-6f2a-4038-ac50-09582c294a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187232, "uuid": "62630bbc-40a0-4f86-bbe2-9a179fb6b6c7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6cbf49-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219222, "uuid": "f14e77a2-45a6-4762-8f2d-a5084f7d08df", "comment": "Malware payload (ZLoader)", "value": "e54f72b1de3e97efe28c97470d3b00f3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219222, "uuid": "847b4b83-fe4d-432f-a20c-46549398fa78", "comment": "Malware payload (ZLoader)", "value": "b916ee9ac5a31baa984fa1f21caa27f09e4441862a49de9173c5ee69866794c1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219222, "uuid": "54051e24-2c3c-4a60-b5fe-46383429ebff", "comment": "Malware payload (ZLoader)", "value": "1eeed3b2fd10ff8f2b61237d23648e086fca677d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219222, "uuid": "64f24e59-6044-471b-8d66-94455821042e", "comment": "Malware payload (ZLoader)", "value": "da4e1cd6532034341fdb5d1568a028ead9d4a9f5cfe2a4cf18e6c08a8c9e64b3dde3771ce3f2dc709a8a26ff2e3a81c5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219222, "uuid": "490b44e5-b7e3-4ff8-998b-c1143d7e261a", "value": "T194F284E3BB95ED65CE484339486B4390A712EC9197A7938B3384F7293FB1BE04D02587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219222, "uuid": "0249b317-4e81-4ca7-9896-9e58ea4517e8", "value": "768:2PqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ+Q+5hrCaI58tfC9HY:Kok3hbdlylKsgqopeJBWhZFGkE+cL2ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219222, "uuid": "a643a9d6-e549-4650-a5e6-4641398899eb", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219222, "uuid": "dbc62631-17c8-4913-9aa4-e9310837f644", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219222, "uuid": "da54358f-bf73-4293-b8f9-cc26c910604b", "value": "SecuriteInfo.com.XF.AShadow.1000.5196.20073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33559a9c-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219176, "uuid": "5b226f8c-82d6-4009-8aa1-1794152c4308", "comment": "Malware payload (ZLoader)", "value": "3f57a4bc544d99554cc22bf2830d382f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219176, "uuid": "d91ac861-787a-4abb-8707-bef32f3915b6", "comment": "Malware payload (ZLoader)", "value": "b91b0dd75b082180cbe8635b05a98410233831b5faae5168aee8f9299b5484fd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219176, "uuid": "cd2f2a61-1ec6-47d7-b01a-dab816314849", "comment": "Malware payload (ZLoader)", "value": "e8b44bdc89d0d01711674e8d29fa2b1c0854d013", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219176, "uuid": "dd007316-848d-4658-b0b7-200a182e3509", "comment": "Malware payload (ZLoader)", "value": "65e6049f1d5758892798ae7d810b4059cbe8780277a907b87b00ca29b603ee3d39d49f6871caddcd44836ccce8a0e15b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219176, "uuid": "4ce80491-55b4-42de-8d92-8d6774bc4e17", "value": "T183F273F3BA96EC65CE584379086B43906723EC5117A7938B3349F7253FB1BE05A1218B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219176, "uuid": "6055fd02-e024-445a-9733-32b2b5b31924", "value": "768:0PqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ273+1pPcLHCT+3v0Lg+:wok3hbdlylKsgqopeJBWhZFGkE+cL2NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219176, "uuid": "ec55a111-1bca-46fe-92f0-973cac6fda70", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219176, "uuid": "76d58e17-4c09-42a1-a2c6-35d3e384f0a0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219176, "uuid": "8cc7f2bb-8893-4e58-8b74-d57b21dd7d06", "value": "SecuriteInfo.com.XF.AShadow.1000.21414.4259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428db2af-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219202, "uuid": "8bea58d8-d1f8-4c12-9d6b-6507c7bd26ea", "comment": "Malware payload (ZLoader)", "value": "f7a5636823fa8f31ead3c2acab3fb999", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219202, "uuid": "ca3f06e5-4904-459a-8cb3-ce90a9c49820", "comment": "Malware payload (ZLoader)", "value": "b91bd79e54b479982cc3dbe9eb1ca22b2c91595e80ffc758c06ba54eb0ee4650", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219202, "uuid": "b455c064-a0fa-412f-9947-ddbcea85647a", "comment": "Malware payload (ZLoader)", "value": "d755bc88892cfb653e6c8fb1b05637af916aa22a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219202, "uuid": "4c297c30-8cdf-44b1-a487-ad16051a4747", "comment": "Malware payload (ZLoader)", "value": "76af62d5a5ca9d428218bc2696005ed0b9def800ac4782062b00e84116c150c6f969d12ca569cf080c1aeb070a446a08", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219202, "uuid": "c483747f-0e8c-4987-b239-df89b1a8bb37", "value": "T127F252E3B785DC59CA488379486B8791A712FC51576B83CB3384F72A3FB1BA05E02587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219202, "uuid": "eb2fe62e-2335-4538-819d-99072405af27", "value": "768:5PqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJqy7AaZOow+wleULuY:Rok3hbdlylKsgqopeJBWhZFGkE+cL2Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219202, "uuid": "b47ce71e-9e0c-4f99-b165-07e52353c007", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219202, "uuid": "f9f82c3f-df62-4b19-b6b7-7cf69941814a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219202, "uuid": "a3e863f5-df3c-4882-9285-a43e159b46cd", "value": "SecuriteInfo.com.XF.AShadow.1205.29880.21615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9341ac-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680159327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159327, "uuid": "b7ac1aed-18c5-4020-80c2-59de326ea822", "comment": "Malware payload (Stealc)", "value": "89a133e7158e8bb6e2614a7c9bd7ff5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159327, "uuid": "3a89fdaa-833c-47b0-b8ad-36d36983fa15", "comment": "Malware payload (Stealc)", "value": "b974225598477c7a4692e46cb12da74272a55f762f4e4b2539ce43ea5d502b61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159327, "uuid": "4d9288af-5041-4f8b-8bfe-a800f4b10a66", "comment": "Malware payload (Stealc)", "value": "64828241ea259e0fb774e94807ebb6d4806c4593", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159327, "uuid": "9eb2a2ea-2a8b-4d3c-8956-8e0119c69906", "comment": "Malware payload (Stealc)", "value": "a246b749a3d45b145827073d481a520954c0a97d522f12d446548eaede2fa765885bc7e6d6073768281c789c0e6e8628", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159327, "uuid": "55831958-0dc6-4535-889e-094d4cd969bd", "value": "T14DD5821DB1D0D9F4C649517B338ACA6AE064B6752F463DA3BBD0E7AB22340CFD552B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159327, "uuid": "97ea7959-f527-4f9a-bf8f-aaa56319892d", "value": "4f49b28f7be60d11310d563049d6e2ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159327, "uuid": "1da73e25-d03a-475d-a2b9-9cf16ecb5e8c", "value": "24576:IBHp0AVAyuFvrOaq7Dk17o3SFGAcRbNft7+xElgjRcDJLX2FmI7oyO:IBHSQkFSDk1E+GtJNft7WjjRcVLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159327, "uuid": "25199105-f96d-48b9-b781-23deed716e5b", "value": 2776000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159327, "uuid": "02194865-c81b-4fb4-a5c2-76281687972e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159327, "uuid": "8c3fd405-d707-491c-a56d-5733d1ab82fd", "value": "89a133e7158e8bb6e2614a7c9bd7ff5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255c15e3-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196819, "uuid": "68733651-0ee6-425e-847a-6eeed50779c4", "comment": "Malware payload (SnakeKeylogger)", "value": "f25a0e88bfd368df629137decafe4d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196819, "uuid": "0e1dfe6c-d935-4601-b5e2-8f430c214e1e", "comment": "Malware payload (SnakeKeylogger)", "value": "bb7ae35b61a135ad6315c7bb85c66bf7346d1c1d031bdd1053fa7c82ebd2c1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196819, "uuid": "7348054c-9cd1-4249-bf55-c2fa7ca7eef5", "comment": "Malware payload (SnakeKeylogger)", "value": "19c8794e04a32f9fe8d7e30936e9c3abb2c8517d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196819, "uuid": "1eec1fff-6ea2-410b-b4c8-9fbb33a0e120", "comment": "Malware payload (SnakeKeylogger)", "value": "1c6454b086f1ae5b1c052f1f5cd4300fa1c30daff90ff73d5b65e5d44327de690ed464d0f31a3e2d630fb89956b4157f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196819, "uuid": "00863e08-63a8-4672-afd0-bdc5c964cbea", "value": "T199D4F15426D9C649C02A837CD2F4D6B1A7BACCD9D272C7274FC9BCC7728F3968921186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196819, "uuid": "5c81b037-7889-4cb0-b5a1-424163253868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196819, "uuid": "279b84c2-11ec-46f8-b57f-517c80dda552", "value": "12288:5RaLvwDndip7oQOUh+rYp20ryulJ4Lqq5OPfreUimOMt+q:5u+ndQuYblSLxIPf/imXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196819, "uuid": "b2627b73-ca7b-457a-a616-cdfabd10f1c1", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196819, "uuid": "1729ad54-7eed-4d78-98df-e7b1aee03da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196819, "uuid": "5958795b-c504-4f2d-ae4c-b1fc6dd38508", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdefc47d-cf30-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680204484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680204484, "uuid": "01eea0bc-09bb-4a9f-9512-9f215a4b89d7", "comment": "Malware payload", "value": "242e99979a3db8b0f4e1dfeb5259d490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680204484, "uuid": "6ddb2813-80df-407a-b7bd-ce3e57a3bfc5", "comment": "Malware payload", "value": "bbe2edc7400d0104700d9e98c69a46932cad47779283209a4fa3b035d46daf09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680204484, "uuid": "7c0888e6-f148-46c2-85ac-1e6b92a9dab8", "comment": "Malware payload", "value": "e221b9efdb05e767878a43232a0bea02c1e573dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680204484, "uuid": "bd6f9f93-b197-40c3-9758-1953325ae432", "comment": "Malware payload", "value": "de2eeb348f1cce94fa605c0fe6d5cdcb0bc3c40467effe44a8db4b9f4a82138a353b7b1d97084ea0f2a20ac121e42193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680204484, "uuid": "b7903f27-6343-497c-86bd-c9f8a586fd17", "value": "T1FBD4F15436DCC11AC665873A82F1C2B0633ACCC4EA79CBA35FDABC87B2CD746541529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680204484, "uuid": "5e27e503-13ed-4659-9bdd-5cdd4a410a31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680204484, "uuid": "aa3ddf41-c3b5-4167-acc9-5dc7672b4cbd", "value": "12288:leJ/sIuNNh6jszPXHF8wLqEnU5l/CBnTsUxI8/qMOqS4simOMt+W:1QjsrXHF7bICBnjl/simX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680204484, "uuid": "633c8558-bd76-4a7c-bd27-b1042c21fcc2", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680204484, "uuid": "6871bc0a-586e-40ab-a6bd-81e90d82f46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680204484, "uuid": "f55576ca-9e8c-4244-a37f-c89984debac6", "value": "INQUIRY 20230330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66962f17-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680161710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161710, "uuid": "ba865af2-7d9d-4ea9-a9d8-b14d88c69c90", "comment": "Malware payload", "value": "88fafedef12b808b3650f36970987b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161710, "uuid": "d1408738-3495-41ff-aacb-8375e60b239e", "comment": "Malware payload", "value": "bbf6413bd1c156ae4569ec8ca3c8d803e8739405f3348a9713ab4149afcf0363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161710, "uuid": "e8056f9d-4cc5-4d06-b40a-6acf9266498b", "comment": "Malware payload", "value": "acc1c19abf7a649b871a0ec4776271b66b8893fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161710, "uuid": "4d95aabf-aef7-4d45-a658-b57a9d344b3c", "comment": "Malware payload", "value": "21668257481367534cdb6cf898efc837364cf0aee1525a5a4e58ff52d84d3cf289e868b77068d1af4bdb39e58ddb9804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161710, "uuid": "90248092-87d9-41a7-b9f4-3ae3d3579fd7", "value": "T16DC36C9A326852FDD1AED076C5D2161BD3F1B84199BA8B0E036509AB1F33371BD2E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161710, "uuid": "87b304fc-f1c5-4a7e-8a30-417cc826fc62", "value": "67338adb4c5d3b6e6f876d5ca7678226", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161710, "uuid": "b77a9c8e-269a-41a8-ac04-65d8eb84181b", "value": "3072:0CqQK+IyoXptZ3hXJBGahVbJhs8PIOAwP4n+c2q0c:mQK+S5r3hnGGh54V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161710, "uuid": "bb73b0ae-9788-4b07-b23c-e66df28ab81d", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161710, "uuid": "949cd00e-6a51-46db-ba8d-2e5abf46d066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161710, "uuid": "66c2fc81-d8c4-46ec-9ecd-209e5bdef73b", "value": "B0A4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48a179c-cf22-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680198321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198321, "uuid": "7b43e422-b5bd-42d2-ab1e-2fd967f9c0dd", "comment": "Malware payload (Amadey)", "value": "8c78634daa068fc8e7af933c774d4b6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198321, "uuid": "281f94a1-52b7-423c-84fa-d9f08a46442d", "comment": "Malware payload (Amadey)", "value": "bc0946ec11ae2dd253ccbb7d6273ba5446800b08c9a6570c09cba5449d69613c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198321, "uuid": "f1f26eec-7e1e-4b32-aef4-b2ceeb695a59", "comment": "Malware payload (Amadey)", "value": "ccf9a4b1056bbe2877be3e8b1baf69868bdfdded", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198321, "uuid": "8593ed25-57ff-42f7-885b-e8c7492a7884", "comment": "Malware payload (Amadey)", "value": "89002b15e9fd771b38ea493cb6faf1a69b0a3445c5298809751e50cb441487e164f02f6e699e13bc5683f16276ec1730", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198321, "uuid": "130413bf-8ba4-4e2e-925d-f530ac855c55", "value": "T1C7252326A5D85233E8715B700CF603DB2B397DE2493CD71B268A899E5C326C49C727B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198321, "uuid": "0940d658-8820-4620-ba98-cbfcb69893e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198321, "uuid": "a4c0c8b8-d99c-48cb-9618-202a0d519756", "value": "24576:HyEWtYuuHZFCEljYlzI4dIOg3zomqyWO3hNZcf:ScuufCGkJd/g3zo5yWy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198321, "uuid": "dbd4246d-57b0-48c0-986b-2bbf4481c774", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198321, "uuid": "b4c22d53-d20c-4aa6-8551-284eaf33bba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198321, "uuid": "c3e622f6-24c6-484a-b878-872dfb54842b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac721595-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680161398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161398, "uuid": "9fabf856-3f27-459a-b2fe-e5f06e730221", "comment": "Malware payload (Smoke Loader)", "value": "ec1fff4cefbd06fde5b6b3e9f8c585c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161398, "uuid": "af2acd38-b98e-423a-ab3b-5ea46a511d2a", "comment": "Malware payload (Smoke Loader)", "value": "bc5db4b7aa47a3311d6972621231889ab17768a1c5c424c8cac9a791edd9d65f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161398, "uuid": "1aafb40a-6130-48e2-ae51-f715de269735", "comment": "Malware payload (Smoke Loader)", "value": "5a94f70dd14dbe8329b0d0f9764d79047ba79d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161398, "uuid": "1bfd7609-1609-49e5-9c14-2bd7a63880e3", "comment": "Malware payload (Smoke Loader)", "value": "eab0b681a8948d35b42ec462aaaded5ae3bfc7f5dd2f5c7994a47ac122f64b843de7d3d208e01b908af6c52b38634aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161398, "uuid": "0e77b5c2-2fe7-4c29-80ef-bdbbda047e44", "value": "T1D444CF127BA1C872D92B417A4811DAB45A3AB8717B65CFCB37841ABE4E303D2DB35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161398, "uuid": "8dc38238-1469-4040-8c6e-1a49e954ea6b", "value": "fde2d3c5c6b5080c428e56f6f2289988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161398, "uuid": "120d63c4-8631-43d1-af74-0e2653027973", "value": "3072:Ybn8RjF5mN8X5DE9ALL8cnx/mQKbIiNLIPxXKLTXVES8UyTCTHvb6CB4P+4a1r:WQjzh5DE6LLnZ/KHNE0LT2fUyTyPbSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161398, "uuid": "21441525-5113-4d15-b6e0-197a803a8db4", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161398, "uuid": "8283308a-f7fb-4f69-8caa-415d4791a599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161398, "uuid": "a99338dc-a6db-444c-9d92-61c6917b082a", "value": "ec1fff4cefbd06fde5b6b3e9f8c585c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ca3bb2-cec3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680157528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157528, "uuid": "129a11d5-92f1-48a8-84ee-ef1659b48c98", "comment": "Malware payload (Loki)", "value": "2734b7281a4e326c2422d7e18b071688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157528, "uuid": "ed9c5a35-8795-4a0f-9424-272ffd2982b2", "comment": "Malware payload (Loki)", "value": "bd636a268d4511297bcf90fde8103829bf21a31e7075b93aae30824af3e3703d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157528, "uuid": "33a3d520-fc16-4f45-a301-b66a13897261", "comment": "Malware payload (Loki)", "value": "18742e75e68ffa9cfb4563327f7b0be60e10b978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157528, "uuid": "5e230778-8cea-4df5-8142-e129b164c101", "comment": "Malware payload (Loki)", "value": "dd8e8b44d8f49e8f6f787100df951de4611c3c474a1a4a94945c908820639cb4093337c05421564ea96a92d4f2eef5f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157528, "uuid": "f55fb83c-bc76-432f-a50a-3df5192c5f9f", "value": "T10AD4F12032ECD11AC662877D81E4C2F1277ADDC5DB29CBA31FDABC87B7CA3465421196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157528, "uuid": "d6a0017a-285a-4652-97fd-f2cd77c7427c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157528, "uuid": "c6b7b466-0d71-47f8-b88a-7ed9c1a71750", "value": "12288:7eJ/sIlRNTh8imOMt+PczZQUmxl+1fKcWRXHRcHf4g+zFuLue:0tSimX7Qvxl+1fNcXqHwzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157528, "uuid": "5a7ee605-2aae-41ee-8863-4d508f5c43f7", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157528, "uuid": "d298413a-20fd-4013-9c98-1c491123466d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157528, "uuid": "f3289ba5-cc91-431b-8acf-6f90276b2365", "value": "Quoatation63688.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517778eb-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload (ZLoader)", "timestamp": 1680219227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219227, "uuid": "d464ee33-f528-4614-aa6e-2b5c3d151b51", "comment": "Malware payload (ZLoader)", "value": "95b76e54f8af81a0e045ca25a3190633", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219227, "uuid": "4747f195-838b-45e6-ba33-0d23ba79d587", "comment": "Malware payload (ZLoader)", "value": "be79799e584cfeac364c9bdbdcae57e05fb4c94bf59886e3325efd1bdd9302cc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219227, "uuid": "313de714-fd4a-4599-9976-8d81b7955574", "comment": "Malware payload (ZLoader)", "value": "2aa41013eb9ee260563341eb79a860737e495546", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219227, "uuid": "14c7e8c8-c5a1-45e6-9bed-c281c54c94be", "comment": "Malware payload (ZLoader)", "value": "1da9a0754199da4705ef80a305f2d7570fc22a9c966422fce71be8cf4d8b8c5ad11fb1edd30b420e0a9a55873f4fe6d7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219227, "uuid": "efc7e92a-45dc-40b9-b370-fe32f8de6502", "value": "T12EF274E7FB95DD25CE488379487B82906712EC515B6B838B3385F7293FB1BA04902157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219227, "uuid": "9a580475-69e2-4afd-97d8-6a5c5022ec33", "value": "768:VPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJNkVgnmcghFpM/u/:dok3hbdlylKsgqopeJBWhZFGkE+cL2N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219227, "uuid": "9f5d4484-b6bd-41a7-8d50-d72924512b18", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219227, "uuid": "90d7a0c7-acdc-4843-be81-5d01c1a274da", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219227, "uuid": "a0907386-ecce-4ce3-8c14-3a49e5ca7687", "value": "SecuriteInfo.com.XF.AShadow.1205.1391.24007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae661279-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170850, "uuid": "0ad316e2-afe1-4034-acea-f00524ac2eb2", "comment": "Malware payload (Mirai)", "value": "099c44b0414d89a8070e7e8b1aa7c407", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170850, "uuid": "e057974e-028e-4619-9e81-8f254b1a2ebb", "comment": "Malware payload (Mirai)", "value": "bfb1568d25b23d73e46006b856fc7eaf43fbee669576a9d5e25b3a4b6dbd6942", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170850, "uuid": "97087735-5722-49bb-83b5-2c8e83a440cd", "comment": "Malware payload (Mirai)", "value": "9fcf22480f01f02dbe2d9be023161f40adbd5b46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170850, "uuid": "fc8dc760-f5ab-42a6-af37-76a042e1611d", "comment": "Malware payload (Mirai)", "value": "f202dc7d1e348b7c103dae5bad3c60ad3c70970df3bc09e0986b1f21073af926f1c3d2055bc114fbda7012d813d2c821", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170850, "uuid": "711cc8b3-ae50-4421-b01b-e912350a1fe5", "value": "T19C03F751B8829A37C2E1137ABA6E5A8D337163E8D2CF7217DD214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170850, "uuid": "00c14f3e-469d-47b5-82fa-a2fb176ff099", "value": "768:MgA/7YCbisG5f0OJnlUlcOlF5AdwAhb9X7WwO2v+bz5CqiLXoThB/NtwWJ:MfrbdG5fblUlfbgjCwdv+MLAwWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170850, "uuid": "777765f2-7193-488c-ab38-eb1dd1df8171", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170850, "uuid": "d13b8f69-ece1-4b29-9c04-55c0c512049f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170850, "uuid": "eba5db7b-41df-4d9e-b775-c2addac37269", "value": "099c44b0414d89a8070e7e8b1aa7c407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdc02c9-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165000, "uuid": "0ee4795c-4b33-4825-a2f2-f7e09ccdaeda", "comment": "Malware payload (AgentTesla)", "value": "956338c4bae384859379a6c047c52aee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165000, "uuid": "b5d90a58-2685-493b-86b8-b26de3705756", "comment": "Malware payload (AgentTesla)", "value": "bfed5d307bbc8fab5ea5d9bdf79a62d5c6b5c6e907a3a291591c00a5f48d82f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165000, "uuid": "7da767aa-f329-4d63-a673-46f47337a090", "comment": "Malware payload (AgentTesla)", "value": "7f94655807dfc45eab33294f59479be325085802", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165000, "uuid": "733a5e67-ddbd-4779-a3ad-b4c0b7992f01", "comment": "Malware payload (AgentTesla)", "value": "e84966337bca2d500189464cd8ba66fab77db61b63eaf963021d50f3339ff0be4f08b8e44b3779eb8b521598fb190bff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165000, "uuid": "9036c123-34ef-48dd-9849-0bc3438b1b1c", "value": "T1CF354A41EBA61460F0104579216B7D1FCD22AC8D99EDFB6E190FFF31F5F221A5C92A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165000, "uuid": "adfb9da2-26c1-4466-b9d2-1fadf7635f87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165000, "uuid": "a3b28174-5569-4831-873f-fb908ed12d4d", "value": "12288:sQ3PlYuO1222PwXPzVWaqhP3C+FyFxHhZ89VPbNEdF8gKJSaK9fVu/8pt9r/lWvp:sQ3NYV2QzVZqIRWXGIgXawRptBlqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165000, "uuid": "73c1d8f9-1842-4653-afbb-236ee5baf37c", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165000, "uuid": "bb42b900-eaac-4857-89fc-cc67499efff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165000, "uuid": "cb6be407-872c-4a41-aeb9-8e99904cc936", "value": "Quotation-092834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba3a0c5-cec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680157826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157826, "uuid": "ef90d98c-e3c4-47e2-a021-0ebb794a89ae", "comment": "Malware payload (RedLineStealer)", "value": "3421998c54dfff6ff4104adbc1309e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157826, "uuid": "3fe66b17-6fe3-44db-bb2b-454de4a1a6e9", "comment": "Malware payload (RedLineStealer)", "value": "c05fa38aaf010516cc3cb3f6f6afb7c90142bf3493dc030adbd5473377d10f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157826, "uuid": "ee6582eb-a8e2-4c5b-b7e8-cb49c4398f4a", "comment": "Malware payload (RedLineStealer)", "value": "9480c29ff2a0e55d5b7dd1f091fd0dc67fd1eb0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157826, "uuid": "1d1bfaf0-1a3d-4239-a315-e63cc12997bf", "comment": "Malware payload (RedLineStealer)", "value": "f825c789f990cc0f1bafb1cb35b3066c86cbc6472cc456ed548bd2727fd2e03ba447e6dd0a4ee2f28e263930af1c9b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157826, "uuid": "39ed5cd8-d1b9-4666-8755-e4bec6fe1f5b", "value": "T1CD2523575BDD4061D8B16B7028F707C70B76BD328DB4A33B278A2CAB58B26D0613172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157826, "uuid": "66a809b9-a926-45d4-936c-3b30756e8e5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157826, "uuid": "76ff77f3-7398-42c3-a343-0212a8aa1fe5", "value": "24576:LyJuLinih+J8fb/Vm3603FtdN7j/YAVaeWckk:+wLinih+Jp6MFViZck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157826, "uuid": "2b8519be-2096-4194-820a-bce36fc7e2f0", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157826, "uuid": "95676712-399f-460d-b2cc-93084ca7e14e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157826, "uuid": "b901b84f-2a29-4d15-a7c0-6e1b5bebf536", "value": "c05fa38aaf010516cc3cb3f6f6afb7c90142bf3493dc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f246f661-ce94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680137463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137463, "uuid": "ca7239a0-edcd-4f50-88f5-32d832a67a21", "comment": "Malware payload (Smoke Loader)", "value": "61f9a1d18a0c61a1c2cb999c8b27f62e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137463, "uuid": "0614019e-7d5a-4dd2-ada5-9f5c28b189ce", "comment": "Malware payload (Smoke Loader)", "value": "c0963c6bcc7e76b68c50177807d843dcb43aa58b2ad67bb8d7d3689f4ee00143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137463, "uuid": "91dda7fa-84a6-4948-b8ac-cb45bfc50690", "comment": "Malware payload (Smoke Loader)", "value": "a18eb6ea843f780cd364844e553a6d7eba573ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137463, "uuid": "5ea0d8d6-4b9b-4ae9-be76-543f64bd5bc3", "comment": "Malware payload (Smoke Loader)", "value": "9dcbc538e8ea3ff97f0c7e1a0f67be141a3734c8aecbe5ed41daeb3e293a1b36ab01d598b3ea467c3b1240dd0facf7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137463, "uuid": "eb503ff5-d2f7-423f-a244-4442bb03e4f1", "value": "T1D444CF12B792C472E91A45794D11CBB45A3BB8F15B118ACB2B946FFF4E303D2DA32346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137463, "uuid": "6e57dcd8-7159-47d3-9ad5-33112e235482", "value": "2d2bfb9c54ad9b595d71acc7d26596e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137463, "uuid": "564e4329-38fd-46e9-806c-ba7aaf545564", "value": "3072:z3PSzkpQ0Y8XPD193LBWwl6Of1p1QRrllZZx2IurU/r0Ewt483Zph:GzkKuPD1JLBn6ONpgPxuG0E+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137463, "uuid": "26247bc6-2feb-4bf5-a1de-24da56754c6c", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137463, "uuid": "62b06196-96d2-4461-9307-03c905456372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137463, "uuid": "4a0907f5-d5ed-49f1-ac04-d79b6a5475f9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9413eb-cec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680156027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156027, "uuid": "1e784927-f392-4477-9e76-43f3f9d68787", "comment": "Malware payload (Loki)", "value": "54ea9e034cc6c0c76d348971fa66b070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156027, "uuid": "d077592b-f258-4257-9379-1e2a8394479a", "comment": "Malware payload (Loki)", "value": "c130d7ecfd4247d4b31878fc53e77b29f6cf286a977964d32069baa3769d4779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156027, "uuid": "dd10bdcb-53f4-4883-a568-284fe7d1ef5b", "comment": "Malware payload (Loki)", "value": "31a3d53f9681ac26493e5cab4358f83a6d77b2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680156027, "uuid": "517aa59c-400c-4518-a7b8-7e5c7981a1d8", "comment": "Malware payload (Loki)", "value": "a020ef5fb86abfcd224a69561e2c987938e75ef769bc93e10647824423f7a0ec7ec4eed98c787a7335273f7f01efa049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680156027, "uuid": "aa549a1d-b2ce-46d6-9b64-2b97b90e0a91", "value": "T1DCD4019036DDC52ACA6687BD81E4C2F0237ADC89DA19C7634FCDFD8BB2CE3465520196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680156027, "uuid": "280616c8-aa56-4934-9432-5484c8ee04b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680156027, "uuid": "4a7c0eb0-30f6-456f-9b7a-a8e1263b68c2", "value": "12288:HeJ/sIZsCzhO63nO7sqH+E8auxaUlxbLBlR9eqv8QimOMt+ZR:50gSO4qeE8aG/dLBli1QimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680156027, "uuid": "41cb2626-d99a-488c-b1f1-c14fe75eaf01", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680156027, "uuid": "fc08a09c-6fc7-4ff4-abcc-76c46581cf50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680156027, "uuid": "41958831-20e4-40f7-bb8d-2bfbd9898eb2", "value": "INVOICEVM220200200305.IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613aac2c-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680158694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158694, "uuid": "9321dc26-40dc-483e-b07e-6512d353a209", "comment": "Malware payload (Loki)", "value": "be7195f318d625a2cd1e1174fe334751", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158694, "uuid": "a790c20a-7e05-4841-b760-8d9cd6720d2a", "comment": "Malware payload (Loki)", "value": "c1c57c3b4a0243d272c810f86839661234eaebffe0e22cd59ccd421269c8fdab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158694, "uuid": "228c8f3b-b1cd-41be-9aba-b06d474f88eb", "comment": "Malware payload (Loki)", "value": "34d7f20ea6971cbf0b6e2e6d2968d9acc4da5edf", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158694, "uuid": "d4145e77-b051-4ca1-884b-737d85927358", "comment": "Malware payload (Loki)", "value": "870853dad4f6fa4f5de2c136ddee67db328c1438f294996d750f3db7538d7de36ec6f4191ffc801480b5b3a6ccf439ae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158694, "uuid": "9e2627d8-1f7c-4676-9236-ad3ed9a30b33", "value": "T1D9351213F941DE87E099C3F05FA72E99830EBD42B356288311087B5FAF716A8795B24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158694, "uuid": "819a6855-c151-437e-80c0-d9414a4476b9", "value": "24576:8LKmSSMMednEiakAmmjmRakAmmjmm+MXUr8vuX2222222222222222222222a2Tl:8LKKMhaaoeaaol+MXq9UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158694, "uuid": "f1beb568-08b4-4100-933e-128d314933d2", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158694, "uuid": "9ee04c9c-c482-41c6-b190-fbe861424d6f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158694, "uuid": "7ec4b15d-f4be-462a-bf16-f54d44095229", "value": "Expot Shipping Docs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8515a502-cea3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680143722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680143722, "uuid": "ed723887-e571-489a-b88e-da14265c4908", "comment": "Malware payload (RecordBreaker)", "value": "c1be6294af56b777d605ad4e6143332b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680143722, "uuid": "5e5508db-001f-4abe-a329-b1164c4729a8", "comment": "Malware payload (RecordBreaker)", "value": "c327e494f05326128a4b473dd994a20fa0bc7137bdca47a7e1580591ec4f24ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680143722, "uuid": "c1d6436c-cbad-42d1-bb6e-cbd84a42f0ff", "comment": "Malware payload (RecordBreaker)", "value": "0eefd8ea4538c7dfa052fc0649065a1b8954df25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680143722, "uuid": "4dea91e8-ded3-45f3-886f-750c0a1e48f4", "comment": "Malware payload (RecordBreaker)", "value": "67f3600449c4e70cb2e448733acf92373fc54575d08c472ccf7434c43407141daaa7ee3944915a0baed7e44eb39a7f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680143722, "uuid": "c3d72951-8b90-4e22-8b4e-33fc4d2763f8", "value": "T149548F13A2E0FC65E9664A318D2DC6F83E2EFD118E59675B23186F1F19721B2C273712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680143722, "uuid": "5e3b443a-6129-4114-a8ad-ed54f570511b", "value": "0e44420b9a05a744c486eb2348abf4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680143722, "uuid": "410b74c6-2a6f-4b2c-86e2-f166159c9e15", "value": "3072:IB/hrZLM1e6j5khVIPIVu1ptibLwgQZ+MyneI09LAD67tKF19KHCQIxd1FQTCv0:CnLAstetWsgQc3eNlAD67tKF1gCQCQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680143722, "uuid": "b81ab407-1e9d-4654-81f8-b9f47974beb7", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680143722, "uuid": "d25c64ea-a2fe-498b-b0c4-7063b8fed2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680143722, "uuid": "914ec565-908b-4bd8-9822-e5719d238dec", "value": "c1be6294af56b777d605ad4e6143332b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a3ac19-cec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680159324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159324, "uuid": "8b6a3bcf-a3c3-4f59-9d32-3703f9028819", "comment": "Malware payload (Amadey)", "value": "207d4b718ed0261949f9dc91c28bd572", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159324, "uuid": "2246a02d-2510-4dc5-a99b-88019e4da411", "comment": "Malware payload (Amadey)", "value": "c33ef593358c539602e43c65878ad979d7eaf789bbc873d08882cbb96d17a90a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159324, "uuid": "a8ae1e51-85d2-46a3-a0e6-5119947b92b6", "comment": "Malware payload (Amadey)", "value": "fade1038eb9703271d397e1ba022dabc8333ecef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680159324, "uuid": "d28dfca7-aec1-499c-bbae-e8879688f912", "comment": "Malware payload (Amadey)", "value": "18f0fef1b8dd5d7aa0aef89bdbf238a5bb1043dad6b78fd2f5c2d1773790d23d552edf11af39aa0f349dff9eb96b48eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159324, "uuid": "13f1e13c-0f0c-4399-8d14-fe313b801a86", "value": "T18C252313DAC4C471DDB117712AFB03D32F36BDA21A7883662B55689A0C322E8677537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159324, "uuid": "9a1034a2-ee1b-4724-9e6f-e9106835b8bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159324, "uuid": "05315f8d-4686-44b0-834e-9a0da71203de", "value": "24576:vy9Zkd+vi77hmvGcHyHh1nq5ND4Fi1vc:69O4v47f4aXq5CFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680159324, "uuid": "110ad9c9-3c3d-4178-8619-4890d0e68687", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680159324, "uuid": "2b33d186-52ba-4eb4-b8cf-c303c5f02ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680159324, "uuid": "abeb4f59-3d37-4ad1-818c-cb30081e410c", "value": "c33ef593358c539602e43c65878ad979d7eaf789bbc87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f540108-cf2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680202527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202527, "uuid": "6d179e9d-4f70-48e2-b554-138c47159067", "comment": "Malware payload (Amadey)", "value": "0123854649df4490d91d075e3ef7264c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202527, "uuid": "d94ea871-8a2e-49c2-abbd-e44ba047713e", "comment": "Malware payload (Amadey)", "value": "c394724e832505305ef835ae4cdda97e42a098ac2535147939ab5bb8a631fd28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202527, "uuid": "2ac666b0-54b8-41af-8ed5-315faea35eb5", "comment": "Malware payload (Amadey)", "value": "712e362725a18119dc8ae1be10b5ce0ee7f53912", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680202527, "uuid": "a2ca4eb6-25d6-4dcc-889b-5d2f9be6d74d", "comment": "Malware payload (Amadey)", "value": "b077a5b883db1d4ef90345f2145cba91f3b670f94268fc4d95749b3453685ac52c95738f9f2084a292af5769f31e970e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202527, "uuid": "885eac93-3e6d-45f1-8f3d-7212fd8d63d0", "value": "T1442523137AE88533EDB65BB018F205931238BCA15D7482EB3A599E9D0CB369474337B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202527, "uuid": "a1eaabf8-af6d-47fd-bba9-5c04ec1a88e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202527, "uuid": "9214d462-6b27-4245-b644-7566024115fb", "value": "12288:0MrMy904jT9yPP2U0UDJn5OKOs74pArr3kuRANfGlmgPppyS3teRhcmYyIHp0N5B:AyRoH2C74pArr0uRY4fpptehcmPKp0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680202527, "uuid": "231ef876-227b-45d5-b507-adf58dadf565", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680202527, "uuid": "f30a58d5-7ee0-42e5-9fd9-ae5079a8e547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680202527, "uuid": "7d1c8da3-41be-473b-b264-c35cd4c509d4", "value": "0123854649df4490d91d075e3ef7264c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d652c93d-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680161468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161468, "uuid": "eac3c9d3-61a7-4619-9289-60a3cf599d1d", "comment": "Malware payload", "value": "55f520a08d39b31fcb6a33ecc9fc58a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161468, "uuid": "b9881646-5d77-49c9-9696-d1ad1837c3fa", "comment": "Malware payload", "value": "c41b90a7cb696b4be6ef4dbeca736785468249eb226f1dd7e4ae397bf87dd5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161468, "uuid": "2ae98f50-4ef5-40d5-bff5-58aa35df1a62", "comment": "Malware payload", "value": "1331a1aaeee194126b3142558ea7511699ddf339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161468, "uuid": "5068fc2e-9c82-4879-bed0-9f21f2676804", "comment": "Malware payload", "value": "6aab3fa11a724c297f92584e8437b9a68715040a4b4594b43dc377fbc99b3542684e13d7f7db021889bdb61428ae09a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161468, "uuid": "e1b2e6be-9305-4347-bc7b-aac6e7892710", "value": "T1F32633F20AEEB664D73A09F0D27C3553F28CC6A50CD947EA07C216AE55E7849E7CC891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161468, "uuid": "c209ba6c-4666-4fa4-9af5-875b8dc35101", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161468, "uuid": "5d00563d-b943-4590-9c4b-b229471f4269", "value": "98304:mbK+yhQ0J5E1bzc+1p8e33V73XvENGBSiBXiHWbdj0/NYT:m2+yhnClwU3dvFsiBy2bdj0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161468, "uuid": "2b455ea1-3b75-4580-ac74-c58fb5319bfc", "value": 4511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161468, "uuid": "252794f2-f13f-4470-9834-a093a33db3c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161468, "uuid": "6e9327ca-1df6-435f-9901-57d352987a4b", "value": "55f520a08d39b31fcb6a33ecc9fc58a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2392046a-cefa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680180925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180925, "uuid": "38beeb3a-e5bf-4ee1-8fe3-12cb6558482f", "comment": "Malware payload (RedLineStealer)", "value": "585e3c862f24770a231e53b1242f55b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180925, "uuid": "a3256496-16e4-415c-a05c-f4414dce7a3a", "comment": "Malware payload (RedLineStealer)", "value": "c442941c899cf385ac5f92ea8e562912dc0b80c8bd922f3fb70d265b84492cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180925, "uuid": "6e3aad47-6f48-4763-9fdb-e72e0689afd5", "comment": "Malware payload (RedLineStealer)", "value": "37f607b939ab71391689541fd8fec9146a068ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180925, "uuid": "11acffeb-77e3-4fac-8a72-1ccd7dff47bb", "comment": "Malware payload (RedLineStealer)", "value": "4b5180345c8e45f35f3cbd4ff0f0b1123c5fe2a0d19f80e6c3870b4a214afdb4333cc5305e412c0a3f4aee97c5f7733f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180925, "uuid": "9c36bf1a-8969-412d-be55-83c8122f74e9", "value": "T172252352BBE85433C8F4133058FB43970A3ABE914DB8572B6746A96F0CB1B80667177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180925, "uuid": "b35eb7c7-ea93-48e2-bf4d-c30aa8d2c2c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180925, "uuid": "f9af4de1-916c-4e07-958b-0d0a165ddd0d", "value": "12288:2MrUy90ffZv19TSeWO7ug9nYuEwHZk73qhyBPpywwpo1LbYZk2ximnXWbq1wZXYH:2yyfx5KuxHZoREo5bBEXExIC8w68l6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180925, "uuid": "6126cdce-79cc-42f1-a24d-ccf2fc3b1d5e", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180925, "uuid": "4c49b926-3359-49d2-9c04-f1d13b96f95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180925, "uuid": "6ced809b-f251-4f72-8b02-6a2cb33f85f5", "value": "585e3c862f24770a231e53b1242f55b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af4e0c2-cf0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680188292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188292, "uuid": "a6cd96d0-0d79-4d93-a5af-d83453810c0d", "comment": "Malware payload (QuasarRAT)", "value": "c7e2ca49d0023effd43ee6d974bb7bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188292, "uuid": "4eb484d4-8462-403d-8003-ef5999af28ec", "comment": "Malware payload (QuasarRAT)", "value": "c478f88f08fc3c4f92c210ab09f2c109d9a741486812e34dd128030d9c891b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188292, "uuid": "8bc32ce5-b154-43b6-816c-c3139e60908f", "comment": "Malware payload (QuasarRAT)", "value": "c902125fcd01e64ee821b22c88266b04a9d798d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188292, "uuid": "afd68dce-479f-447e-bda7-64f6c59b6c68", "comment": "Malware payload (QuasarRAT)", "value": "b80bca37dd7040037f99cf35b6466116e2bbc415f45d88f909136df113fcff40768e7d069f4ef4f7646aa2e3c89068e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188292, "uuid": "0d14ce81-9ead-47ee-bc99-9d382d83d71e", "value": "T1E4A339317664EA52DB2D877A52FB5A0942B156EB1701D23B2DC4ACC12F127E2D31AFC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188292, "uuid": "5d99c2a1-6178-4ffb-9487-ecc299797ffe", "value": "1536:/zhOknLY2wOiBXEEtJ9cmTPRwf1wHbAzHx/7ALc29uRBT66ci9:b3ncJyCRfbk7QcYuDT66R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188292, "uuid": "2e0d7007-c4f8-4703-83c5-28dd67eabf55", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188292, "uuid": "798b60cc-c8a1-48d5-8ad5-756d9c7e4af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188292, "uuid": "9bc5eaed-57dd-4a09-9379-cfa9089e1bf5", "value": "c7e2ca49d0023effd43ee6d974bb7bb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f88b15-cee9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680173741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173741, "uuid": "fc4d20d4-3618-42c1-858a-6b78763c33ff", "comment": "Malware payload (GuLoader)", "value": "03fc892441840c28beff5933a322810d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173741, "uuid": "e35e1a4e-7302-4076-a2b8-80e4d7e5e2c1", "comment": "Malware payload (GuLoader)", "value": "c48a025e66627657f17b98d15b13e9326244bc38d7019604e3242a6d8ad96430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173741, "uuid": "c2009ac9-4151-41cc-a2ac-054a740cebc5", "comment": "Malware payload (GuLoader)", "value": "58d9dff39505fc48b9dbaca71312f4fcba823d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680173741, "uuid": "5c933d3f-e2b8-49ad-8e5b-d5a2d9a58594", "comment": "Malware payload (GuLoader)", "value": "f38763e768bb9190e808cfbef9c26741a83e4e3cb94e23f0b7992afbf4f5555c150a71eed50006e1e67c9f62dcb1be62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173741, "uuid": "558a5480-7eb2-4464-891f-6e2d4b8995c2", "value": "T1BA4522027F45E8B7C65646340E73D7B0A370EC855612571273C1BF9FBABA3A0590A2BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173741, "uuid": "3192d2c5-d6e8-4f89-81ff-942778e617dc", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173741, "uuid": "01f67ab7-4463-4b96-9b0b-56a65e253969", "value": "24576:EO/lnSVsQ5Tl+rs/RKKkkJiIZeHaHgkhYWppfXRmereVpGICAivg5ofYEsPVbunL:EunC1z+oRKKkkJJ/AiYWpJBmerebGIC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680173741, "uuid": "10aed71b-45ab-4cbe-9043-a07c4ef8229d", "value": 1275440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680173741, "uuid": "fd012500-bbc2-4b73-a96a-2770e6c894ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680173741, "uuid": "d7798be2-18cc-469f-b89c-e368ee87d5c4", "value": "orcinus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07dc203b-cf0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680187750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187750, "uuid": "252dc051-f6c7-4c98-b842-f348a70d0a98", "comment": "Malware payload (Guildma)", "value": "07d1514e89bee52cf40b9438fe5b0521", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187750, "uuid": "6816d8dc-3f83-47c2-ac84-931e9c35d79b", "comment": "Malware payload (Guildma)", "value": "c4a278c59ff602133613e542bf2705377cbc52adc87fe295d10b814c0594944b", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187750, "uuid": "0c59d9a7-2acf-4ba5-baf5-5bbe28fc8349", "comment": "Malware payload (Guildma)", "value": "57e1f1908a4d40841b88462e29e48d82036d972e", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187750, "uuid": "20e76016-8edb-4d9e-a767-de35d4e7c20d", "comment": "Malware payload (Guildma)", "value": "259784ed6f202530b1ca121ef608be56f898295275313262632ff8d081391a53f3261a1f4d8d579537b434e5825c958f", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187750, "uuid": "0ab11942-e450-4b05-9b53-01cc04f82670", "value": "T1C0820484D318825163875FE0EDAB7882E0708CBDE64174E5BC364E9EF1973E451E8BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187750, "uuid": "85d175d3-7032-45c0-8511-7c507e7f2f5d", "value": "192:94HNPjEkgvs7PDXogcz/N/NHRm7V0KVtSUd2ChyZHvEJAVS0Vy3Uw/2EQRUwG:9AwBE7UFS2TS0cgxU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680187750, "uuid": "df1b36f6-a481-4aad-bb0e-4d756edbe067", "value": 18727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680187750, "uuid": "7492a606-8768-48a5-8f86-38e20ff84299", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187750, "uuid": "2cf972e3-201c-492d-9f67-e168f3e8eef2", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67de6148-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680180610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180610, "uuid": "b9f8a35b-0caf-4b69-9637-e777a7240b95", "comment": "Malware payload (GuLoader)", "value": "78bbb610f1b6a6668f8acb99d2636b78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180610, "uuid": "4cbc490a-1660-4bdc-bb4e-ca0f8a841214", "comment": "Malware payload (GuLoader)", "value": "c774243283a809b2da5bc8648e46fab1d277c32d50004149d042b2bf0ab38471", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180610, "uuid": "89440700-b408-4585-8876-311f7a6f85e8", "comment": "Malware payload (GuLoader)", "value": "46c3068dd6a0b0b499e39e626c3d62c1965d83f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180610, "uuid": "301a5cb9-f1da-4865-8c5d-4ab93dc27e25", "comment": "Malware payload (GuLoader)", "value": "256f738297c6f4630bd79efc89f48ed17e54cba0bde8fd99a524dabb620cd917d8bc833a2d3d8ca951907b59715c8f7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180610, "uuid": "34e8bafb-b41a-4af5-8aca-f716c409ee8f", "value": "T16B552212BF40C9F7D5224AB24CB7C33557B59E4816025B1B36C0AFAFFEB624169221BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180610, "uuid": "cc073d68-951e-4556-98fc-5efa49a2e38f", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180610, "uuid": "10cc8cd7-6baf-478f-b532-dbcbe781d7d3", "value": "24576:6O/lnSVsbFMIe09fzb0M8Vq2RvtxrEyUK67IxCEyHUZRk9hfa:6unC+F3R0M+q2RrEAyI4MRk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180610, "uuid": "aa139062-a468-4c5b-ae4b-df69bae96aba", "value": 1290424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180610, "uuid": "c1c97fc4-5d95-486f-b0b7-21bd0975f016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180610, "uuid": "49fa1ab5-f4ff-403c-80be-838113d7097e", "value": "172314409-090732-sanIccjavap0003.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d905f4-cea1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680142911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142911, "uuid": "a4a6a47f-e659-4352-b80e-5a124e1965cf", "comment": "Malware payload", "value": "8363436878404da0ae3e46991e355b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142911, "uuid": "6e534639-8466-4aaa-9905-c1f5b1e1909d", "comment": "Malware payload", "value": "c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142911, "uuid": "8dc1b977-cd4c-4b47-86e4-387e4c0d82f1", "comment": "Malware payload", "value": "5a016facbcb77e2009a01ea5c67b39af209c3fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680142911, "uuid": "242be57c-8834-41b6-a7ef-5c695533e0d0", "comment": "Malware payload", "value": "0af39047b0def70f7d5ea4b287df102c69fb79c3c540a98a97b957c96ad65f0d773611fd37e83c3a4fe304fefd4cf592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142911, "uuid": "7592cd77-158e-4065-ad21-695154f45461", "value": "T18351B8ABFE665CFAC24E0B3B03DBC920356EA0D04BFD43C16A9D7497E89B1548855610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142911, "uuid": "ed544bb0-ae1c-4483-8d27-738c98f2edc2", "value": "096aa05b8a2e1f2dc66fc73a1a978a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142911, "uuid": "2adb1c19-250f-4d83-baec-d8032f77d239", "value": "48:atUKzxRhvlNZEVtfbn4m3ZUJSSeJY8JTaIcLoBgs:0UKXktfb4KOJzcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680142911, "uuid": "e6723c65-aa4f-4ba3-a9db-83d792bed580", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680142911, "uuid": "3d738361-2be7-41ea-b23c-60114103987c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680142911, "uuid": "3191a2c5-1d78-42c7-bd9b-53bcf109804f", "value": "Lab01-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c68e97-ceda-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1680167289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167289, "uuid": "e33b20ff-1bb7-4c72-b5a3-0215420bd9bc", "comment": "Malware payload (STRRAT)", "value": "7d7b50c4e1cced7af0aa44e19efc8a51", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167289, "uuid": "8db227e1-4b02-4680-b0bc-671f2ab26d84", "comment": "Malware payload (STRRAT)", "value": "c8e6e9aa1e331606a6ff9cdde5e33c4ce70371a9a5469e17d2f1421846c2f916", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167289, "uuid": "60243660-a3de-4d9c-9427-602e55174ad0", "comment": "Malware payload (STRRAT)", "value": "832605f0bd05501553cc35127d0c60e604c9479b", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167289, "uuid": "178d8d31-9ca5-498d-b597-0c52d5745417", "comment": "Malware payload (STRRAT)", "value": "ed3810e0556fe879a6356d74f8a2f93933f086d9cd4168b187d83f5fef7f123c15ebfb54a42db0d50115380a1d3abb2c", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167289, "uuid": "77bc3370-0cdd-4cab-ba1c-b4c5774631ec", "value": "T125342365400C445B8BD67DFF20B9B689A94CB53BFDBF0D8151E723AF752022D81E42AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167289, "uuid": "7ab335de-8e7c-4168-9931-51da71f4778c", "value": "6144:/Sinz3MpxT+kpPhSzot/egCfavHZZI2vDdTRT3HqS3w5Aa+GiYHVQCl1cLVdR:/Vz3yxCkpPA0t/eDaZHDdTh9BapiYHVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167289, "uuid": "c5786a24-6eb1-4f8b-b0e0-7f686372158c", "value": 247075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167289, "uuid": "91aa6acd-3045-4c72-a188-9e8cddba838a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167289, "uuid": "91226d1e-93d9-46a3-b537-2366e80368c1", "value": "Payment Prove And Revised New Order PI.300611941.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4a425d-cedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680168511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168511, "uuid": "0ce37ecf-3319-4fa9-8817-ffe577e93ffb", "comment": "Malware payload (Formbook)", "value": "c34f997d9025fa9d2328a359526ae018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168511, "uuid": "760d8c13-84be-421d-92cb-aff52d117ed6", "comment": "Malware payload (Formbook)", "value": "c976b524f9b32a66f198e4a462d62929a482c16ae458e6639da9b8e15306c5b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168511, "uuid": "11e95bdd-fa74-4056-99ea-494d5fb1f2f4", "comment": "Malware payload (Formbook)", "value": "bd0737ce383faa1c234f325db92d991f70eea7da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168511, "uuid": "ef1867c3-d296-4d01-862c-88f095203944", "comment": "Malware payload (Formbook)", "value": "f79f0756046a7014c6e0bc4105477b58a138a42052a0391af96d9ec8476d4fded83365ddeae8a606bca37101fc838f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168511, "uuid": "93f95263-d8c3-491b-bf6b-85b092660cdf", "value": "T135341214B1E0E193FCAB0A3388774EBA2FE5D91011B44A2B53385B59BE21A53DE3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168511, "uuid": "1250cc1e-9f7b-491c-bb07-fb236f9c364c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168511, "uuid": "2f50c0b5-1901-463e-9b55-83b72b487125", "value": "6144:/Ya6S/WB288QyvGpPbKJ5IU+3teoJBszEFk9nb1tWLaKt:/Y0/+JBeJ5h+3JzFkTtW+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168511, "uuid": "55e31440-deea-4f13-8ee8-9bad1bafe786", "value": 242946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168511, "uuid": "6d008be3-251d-4749-8f0b-a782577c4158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168511, "uuid": "dcfea192-8ca7-4b1a-ad11-c75820a689bb", "value": "issu_20232103pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee34c6d-ced3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680164542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164542, "uuid": "3f55d115-f1d6-48ec-8270-65f4d9280ae1", "comment": "Malware payload (AgentTesla)", "value": "e0f8c7d3fba6c0dc3b1a5b8d543bcc63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164542, "uuid": "bd6fe0d4-9854-4c0a-8f0d-97d694641762", "comment": "Malware payload (AgentTesla)", "value": "c9a6833156ee70c01a46b2ca35ea92d458b2cc2fb1efc36899b3aaf7a7d00d95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164542, "uuid": "2db33d51-30f4-422b-851c-4c3127ad63c5", "comment": "Malware payload (AgentTesla)", "value": "d5f3cb47e6d8d5e2f284f069dbb0d4578fb25bef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164542, "uuid": "cdbc4651-5ef5-4892-b130-3f5e79d8fbaa", "comment": "Malware payload (AgentTesla)", "value": "03ba5443fe34890a3029978222fca3af237e30b78726530d69cf30a71d7d98658438118acc884d4dc6c4aba9c32cc96b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164542, "uuid": "c652422a-da42-4bcb-8ff0-b47e30455a7d", "value": "T13B05E095BD2A1873F4D9D3F010901A3E07A9BB611061D2C98EF668D9BCCBFA745E244F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164542, "uuid": "87c435b9-a122-4478-b26e-b1da5e1b3498", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164542, "uuid": "adb632b0-6dde-45b6-a0f5-8f1bbc662c91", "value": "24576:ZVZGB/SnUb+Chbs+4TS9fznGnmg0rL4S:DZcSndOC0fznsmg8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680164542, "uuid": "3c0e5e9d-2024-4b72-a472-5a6f4d619dd5", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680164542, "uuid": "ecb1e6b6-2ff7-407c-a28e-193dba0d58f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164542, "uuid": "900a00dc-c1c7-46c8-82be-061642e1821b", "value": "pending invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ef12a6-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170856, "uuid": "4b79ed7c-e6f9-4057-afc6-e6e2533228d5", "comment": "Malware payload (Mirai)", "value": "147b8f16114949814908def7752bdac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170856, "uuid": "456bf1ac-d512-4650-a5f0-ae7d9fb1e5d2", "comment": "Malware payload (Mirai)", "value": "ca23c5b6d54d82256daf3562027093f36d96a2d9ff44e719be1f36be02ac5b93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170856, "uuid": "f1a2d037-50e5-43dc-907f-791ff308bdbe", "comment": "Malware payload (Mirai)", "value": "63b390c7ababe1a5a05f68f25e2232cc86eb7351", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170856, "uuid": "597a9df2-6827-4826-8619-11842399b29c", "comment": "Malware payload (Mirai)", "value": "1e096cd709e9a9182cc89008512d096a8c15a04cca4bad8cf4378d6280c832f97527f6cffa73df7dd239570ad7f1f6fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170856, "uuid": "a4ad717e-ca90-43cd-95de-fbcb545cc3fd", "value": "T189438D36E86E1E74C08641B074748EB56F23B5C893572EBA1AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170856, "uuid": "f7784a4e-1396-40ce-b4d3-20834dc9eb0b", "value": "1536:9aa0brW/Od9hlCRjKknKQXACspfDCMx2+W4:9v0brWGd9XlkKQqpfDQ+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170856, "uuid": "5e2a1401-8e3e-4b78-b980-f03a9f660393", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170856, "uuid": "ed5aa881-0912-4a41-921e-32ff51e90245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170856, "uuid": "8006db94-a401-4715-bac8-1112344f28fe", "value": "147b8f16114949814908def7752bdac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d72555-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158430, "uuid": "328ae7bf-ec73-4072-b634-4ba61f9ca73b", "comment": "Malware payload (SnakeKeylogger)", "value": "935e4db51a59a0115e3dd371a13b9b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158430, "uuid": "3e17a87e-ca77-411a-a31b-e66b31eb3b91", "comment": "Malware payload (SnakeKeylogger)", "value": "ca598fdf9fb15e2c04dbb11f4c4ba49c397029ed14fe2eedbc5c320eea4a00a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158430, "uuid": "267ea261-c24d-4264-8151-313c5c2dcdae", "comment": "Malware payload (SnakeKeylogger)", "value": "6ad75d32c6f913cb7ebdcfdc2a638e9b453655f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158430, "uuid": "a87cea36-80cd-43cb-acc3-c340d80007ac", "comment": "Malware payload (SnakeKeylogger)", "value": "e6680c40e0a903d4e045856ebeea596df7e2f4cabe2ea468aead558be52be7cfa83b6a394eb43dfedb8e70248998b1f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158430, "uuid": "28ef4862-b74b-49d8-82b9-fe57ab651bf7", "value": "T124D4025432DCD616CA66437A81F5C2B02739DCD9EA25CBA30FDDBC8BB2C934664250DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158430, "uuid": "b0298c59-fd49-4694-b386-8864cedf586f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158430, "uuid": "aa0d93cb-afcc-44d7-9781-f5850d4f5c62", "value": "12288:feJ/sIutDihrIpfzpjPMELIKU1EuEsoWayEmr2perimOMt+6:RGEf9jPMELIDJ24imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158430, "uuid": "b29e6072-f743-429a-9680-38558744155a", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158430, "uuid": "cf6d1c95-4da8-4524-a3e0-e7e11fb431af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158430, "uuid": "7264ef74-8988-473d-b318-5304364f5459", "value": "Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24f56bb-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158830, "uuid": "0b851438-a55e-42cd-af6d-faf63090407a", "comment": "Malware payload (SnakeKeylogger)", "value": "44d2425bec0e12569cfba6df6b2a9f66", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158830, "uuid": "6082ea95-5121-4aa8-a2d7-fd90ea53ed8a", "comment": "Malware payload (SnakeKeylogger)", "value": "ca91c53a4aafe29d189b11ddbc1d1dbffcb360402050e93c29b48e3fad832538", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158830, "uuid": "f5d23280-dbf4-4e22-8f30-b1b4ce23986d", "comment": "Malware payload (SnakeKeylogger)", "value": "643e025134439b6520e680b145c1e838b180698c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158830, "uuid": "d277e9b6-a562-4d1e-80a1-0664a4e8e72a", "comment": "Malware payload (SnakeKeylogger)", "value": "572aa1f568aed40e4f69c7bfe394e66279b03dff2aef3815743c3ca194af51a734ca00fcce5ef8284f03628d676c9ade", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158830, "uuid": "0a0abf07-b83e-4b3c-bae5-8b2a7ed15568", "value": "T1DAC4233144D3DD052B8FC105A18E760F128673177349F9CA19C98688F2A579FAD9FAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158830, "uuid": "5a2e5847-1100-44b9-b4b8-385ee38f51b2", "value": "12288:3NvU4pYCSrTahQCM+zmBuO3J3506vKfDuKzaMONhAn:3FvKZ8uhxpjvwDfz9aAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158830, "uuid": "7a359e79-e46c-49cd-b679-c9efe5cb5c1c", "value": 567108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158830, "uuid": "e366c32c-6fb2-4b8d-9e38-b87d05adac59", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158830, "uuid": "a8760332-f885-4956-bd7a-9d95b8739a4e", "value": "NOTIFICACI\u00d3N DE ADEUDO EL 04.04.2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9ed963-cee7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680172917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172917, "uuid": "dd9db313-eb80-4d40-a42e-f8d3dd029d80", "comment": "Malware payload (AgentTesla)", "value": "424d1c81092c76ac4c60ed4e2af71729", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172917, "uuid": "30d1233e-9d70-4d52-88c1-db84eead8943", "comment": "Malware payload (AgentTesla)", "value": "cb1a95879bdec08e04762f3180ab28040288232230c0a10dfd9a9344e0fa21cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172917, "uuid": "dc416a7d-3db1-42cb-8486-b78794f62f8e", "comment": "Malware payload (AgentTesla)", "value": "dff8164676c93499d9117b8c99d59f563dc603dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172917, "uuid": "58abc98b-b9fe-42b1-a825-1c2da47a17dd", "comment": "Malware payload (AgentTesla)", "value": "13b48914975b8358d4794a93abd987180c436e8abd53f5572f4cdc5618301e575c9aa2a5c78c98e67c6a386d805d7175", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680172917, "uuid": "104d4fd0-eb3c-4033-b5e9-ee08fca067ba", "value": "T1B904BED97150B8DFCC17C871AAE86C68AB61747B571BC293A02780A8CB4C787DF191B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680172917, "uuid": "d5eea3e4-a372-4915-806d-e938b7483625", "value": "3072:38MzDbnCWsIhhNzz05DDxz7k7K4adcywN/ivkMK0jTJj8xyIL32C0gAm6:MieObz83xPkerEat3jdjcyILGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680172917, "uuid": "0b4aa3d3-21b6-4ab8-8aae-d1d9a034141c", "value": 186600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680172917, "uuid": "69e5a925-30c3-43cc-ad57-617f3ce9a47f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680172917, "uuid": "dcee9fc3-340b-42a6-ac88-8cfa264ca352", "value": "Commande nr220489 E833080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58584dab-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1680158679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158679, "uuid": "b9afd1a4-576a-48d9-b12c-ecb7ec8cef8f", "comment": "Malware payload (PureCrypter)", "value": "9fb9b26fb2e3654dd0ba957df976ad19", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158679, "uuid": "8cbb2863-21f8-428c-9fcd-b09734660d9f", "comment": "Malware payload (PureCrypter)", "value": "cc9d04f3697655cc92248c96b12944d2c07a2adb78fc781cd3a4513ad216379f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158679, "uuid": "ee2fdc4a-156a-4465-b4ea-d32cd999aa3f", "comment": "Malware payload (PureCrypter)", "value": "d62c69487dc2618527d41ebadea768ce2b496d77", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158679, "uuid": "b044d94c-faa2-4e7c-8602-d0f8c906a0fb", "comment": "Malware payload (PureCrypter)", "value": "ac39f281a84bfab44903a44c2ed2143d2c02e5affad7b2e6ca6d11dfa47f98814a822de48545a4eaadad07c9683af2d4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158679, "uuid": "df3d4b21-88b8-4c20-9de5-cdcf5d66cf31", "value": "T150351213FA41DE87E05587F05F5B2E89830DBD42A39728831608BB5FAF707A8799724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158679, "uuid": "964d9ea9-54ae-435f-bd63-6fdb1bd1d6fd", "value": "24576:PLKNKSSMMednEoakAmmjmRakAmmjmu+MXUcvW52222222222222222222222a2r+:PLKgMzaaoeaao9+MXO7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158679, "uuid": "23e2890b-198f-4775-b19f-88996f478c79", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158679, "uuid": "5090b211-c469-4274-995c-39e41094886c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158679, "uuid": "c7b26495-4ff2-45df-a382-69b1e72e0bd3", "value": "Purchase_Order_PONPD222301643.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ebf7a7-ce94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680137286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137286, "uuid": "46b8b276-c799-40e6-ab05-fe07c755e2f6", "comment": "Malware payload (Amadey)", "value": "bb827f6d5b1d086843fa951b69b8e702", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137286, "uuid": "72c46410-c872-4652-927c-56b668ba09fa", "comment": "Malware payload (Amadey)", "value": "cd78dc0371ea4e348f7ca0e9f4834b44a23289fbe17012ec5c85386ff08b1199", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137286, "uuid": "222c08c8-aedf-499e-a13c-2cbdef5b1cda", "comment": "Malware payload (Amadey)", "value": "243fbea78b86f230a7df649ed959680b272eced1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680137286, "uuid": "adb8e4fc-0d40-4c06-a243-bd19f1c402c0", "comment": "Malware payload (Amadey)", "value": "41d99b2310bcfd28b8b9382461a78d851cdb830e7749944bb8e41262c349ee937ba1d94d47cde6493a6cdc99617358aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137286, "uuid": "dee08025-3edf-40cb-a093-9665b8d72fb1", "value": "T1F444CE127691C473E94A45BD4812DBB45A3EBC704F25CAC737981BBE4E707E28B36386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137286, "uuid": "7180fae2-52c1-4142-88f3-a44d7740dd88", "value": "6d0731e3d08b444b0205bbdbcc6792ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137286, "uuid": "8cd434d6-c6e8-44df-997e-c858e300eb10", "value": "3072:bAFAfpTWg8XlyzD2LXCBFxkqiJq/EUAnaGMjIL9Rtm3ED+bbx4cnYhQ:kAfFIlyzKLXOxbiJSE1aG5L9rm3Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680137286, "uuid": "83af580d-c9bc-47fc-b908-9dec64fde275", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680137286, "uuid": "c435511f-299d-4e77-92d1-57c1d6b5dc37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680137286, "uuid": "bcd7762f-381b-45cd-ad8b-87b5794cd61a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7b8df3-cec3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680157510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157510, "uuid": "9f1513c1-0b8e-47a2-9c17-ab430f24e5a8", "comment": "Malware payload (Loki)", "value": "a2dbd54bc739b5a6b2ed5ad7eb727710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157510, "uuid": "02aa0d89-8a85-4bfd-a564-81daaf3cff88", "comment": "Malware payload (Loki)", "value": "cf30e92c897a307421160bcc8072cd2901b89331de784059a1a1608d2ca80123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157510, "uuid": "494c57e8-d74e-4b61-995e-3015cce57f68", "comment": "Malware payload (Loki)", "value": "09f0ba0326f1075b680186b77940b2d6936ab7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157510, "uuid": "29327bde-fcd5-4cd5-9b71-a2999be2740f", "comment": "Malware payload (Loki)", "value": "997db98890df016e2ffc49099dd22250cd6e9a468331c839568d877ca6b5daeccb800ddff70af2691ab2476f88fb19c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157510, "uuid": "53b0b859-9a65-4d91-8535-1693c2ce8d00", "value": "T18ED4026036EDC516CA66477D81B4C2B1237ECCC5E969CB621FCABC8BB3CE34545212A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157510, "uuid": "64e76dd3-5dbb-4b8c-94d2-93fcdbf11c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157510, "uuid": "01058f4b-157b-40f1-89df-19b50aa6a5be", "value": "12288:geJ/sIK3qhaimOMt+oeMLV0qy75q6NT3L+XN7D9a0V8oM0OldeVaRLlw08:ZIimXj0qy75quTyX95a0V8oLYdsKl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157510, "uuid": "9d530758-f9d0-4f33-b3c4-7e2cfa97b7ea", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157510, "uuid": "53ea0459-d82d-4fbd-a8eb-be77522d1856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157510, "uuid": "8cd5f39b-9855-46bf-a815-d29726f61bb5", "value": "a2dbd54bc739b5a6b2ed5ad7eb727710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b4c064-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (NosuStealer)", "timestamp": 1680161359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161359, "uuid": "84f32018-07c8-4d66-adc9-3f44e4e8c9f7", "comment": "Malware payload (NosuStealer)", "value": "3ec62b0b4b9b267c4783cf99a2b082ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161359, "uuid": "6622299f-db8c-4977-b724-fd1a1d724ffe", "comment": "Malware payload (NosuStealer)", "value": "cf3416fdf617c6fb728acb0a89ec93d4aff5674f6aa0b66ec3629dda2f8f1cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161359, "uuid": "3d0e2c52-50ef-4b67-9228-bf17c013511b", "comment": "Malware payload (NosuStealer)", "value": "a98326f16d3eeed57800827a3928c52db51cf98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161359, "uuid": "f810767e-0d46-4d1c-a59e-befba8a62ac3", "comment": "Malware payload (NosuStealer)", "value": "0fa814c28700df4c3f8e05812fbe488053350d0d9d57363443103cbc5b9866f397aa678a6000a981540ebcab898a8e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161359, "uuid": "2c55cd95-11e3-48d0-ad9f-42d9e9e80072", "value": "T1EBF49F22F2E18437F1332A789D1B927C9D267E106935E8463FE59E8D5F38681372B193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161359, "uuid": "9070c59c-d740-4dab-bc57-0592d9754d78", "value": "97097c6816d59e0e343951d5da613aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161359, "uuid": "9df3de3c-cc19-4a18-920a-d0a9c8602d3e", "value": "12288:zPDiJJG05qrVujzjkv45nG2JoGhkgGt4z9jqCb4jyKrxo6EbpYx0:rmb3GVsfkv4I2Wi0t4B4jPG6Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161359, "uuid": "baaf326a-16c7-4af6-a64c-165c2466a35a", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161359, "uuid": "12bbd17f-b5c0-4b24-a720-2907f133d591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161359, "uuid": "07e86f92-4645-4771-84a3-0fc5cc1269b0", "value": "3ec62b0b4b9b267c4783cf99a2b082ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abe65c9-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680196989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196989, "uuid": "c89a466f-9cec-4784-b8a3-d8fdb4c9f495", "comment": "Malware payload (Formbook)", "value": "566eee948e09a10332982a1f6abe7dc5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196989, "uuid": "9f8099b1-0c1c-43ba-a31a-02f16afcf556", "comment": "Malware payload (Formbook)", "value": "cf35c3a80b37850da40588686972218d720ad63c3060b7fc88df284e11a84a6d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196989, "uuid": "c47d4c7f-b488-4e4d-910a-89e379be60ba", "comment": "Malware payload (Formbook)", "value": "3c5540e68d338b86eafa5555bcd2eb82bbb53e03", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196989, "uuid": "a5833a0c-a1b1-4612-bf22-696f18022592", "comment": "Malware payload (Formbook)", "value": "8cd16d45005c0d5d484d1537749bbc175658d6c974565b9406cafcfe8e1a3df5a02c330d7a0b57cc65d8db6f52165cf2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196989, "uuid": "97699939-f4c2-451d-84a6-1348e3eeac92", "value": "T17F65F113ED049E53D05CC3B87F030D68171E3E09AA46BADA11653E9F3F71A642DAB25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196989, "uuid": "ca0c17c8-5576-4b82-b488-43780470da25", "value": "24576:/TjwBd66akAmmjmvakAmmjm1+MXUPHeb2222222222222222222222K2DfvXCDps:/I5aaoAaaoS+MXvDXUpOj7U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196989, "uuid": "ca1dcd57-949e-4460-b6e8-79a433e8e56e", "value": 1436672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196989, "uuid": "057e0f42-ee5b-46fe-ae3f-ee667f04b9d8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196989, "uuid": "74b06750-cd98-4ca2-acf0-e43a49b5aaa5", "value": "PO 2780 R2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d89ad7-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680160935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160935, "uuid": "8c7daa9f-fd69-4f5e-b041-6ec33b6502ea", "comment": "Malware payload", "value": "0fb6061f7d37424fb9e6d0e76b019c19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160935, "uuid": "2663bd0b-9d8b-4414-be1b-c8de0d9504e4", "comment": "Malware payload", "value": "d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160935, "uuid": "3b1f8326-d4a8-441e-931e-bbb9e3cdfe66", "comment": "Malware payload", "value": "98a64bf7b459f032d6ec5793003bf61b5ae1dd74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160935, "uuid": "9e225750-2ff9-4d1b-ab55-9eae89f81274", "comment": "Malware payload", "value": "32956a7a7d36669bae0e6f81e922655a34d6e55c4d5ff6d0906618dd892ceb357d87bf892d14c7b9940969f46ede9204", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160935, "uuid": "0e18aa40-0777-4b4d-a3c0-fa9fe0cd5d5c", "value": "T16192E848B3EEDBE3CA9E0A7D587276021330ED225943E3174B86C62AECB37D545119DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160935, "uuid": "40d69772-2e4b-45ef-b60a-456bce1334b1", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160935, "uuid": "614aa814-a9a8-4e88-b096-e0b288603613", "value": "384:rKJTa9t4EmnU00ntpXd+042do3X0ikV+RcaKK94kMWC30wExm2NhN:rKJT7Qn+P3X0ikV+2edpvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160935, "uuid": "bc07b2cf-59f3-40d4-934f-42deabafa8ee", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160935, "uuid": "29bebaa8-ced3-4289-90f5-914b15fbffb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160935, "uuid": "b7200c01-f6e4-4d60-b705-c44696501f2e", "value": "stage2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25039ff9-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180498, "uuid": "d75e994f-3f22-45d2-8d1c-c10d870deea7", "comment": "Malware payload (AgentTesla)", "value": "d22ddd0b41c522e471a7df51c08de119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180498, "uuid": "09ec05db-0eb3-40bc-a289-23d7674a9032", "comment": "Malware payload (AgentTesla)", "value": "d104a9413ee081463431a8f5c4493b7a13f34309a99c8fae86a593f0dfbb42ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180498, "uuid": "e4a87ac4-c432-4eb4-b289-ee95a04bcfa5", "comment": "Malware payload (AgentTesla)", "value": "614c7564049869d04795087cf6937d2c6c312451", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180498, "uuid": "67cbcf1a-5623-4f8e-91a7-4b4ca7a1b1d5", "comment": "Malware payload (AgentTesla)", "value": "5a7cd63d320014c844ca0d5659a97ccebd5b6ff6fe4de165c51891d40b1b63228f3fe286e1a558c36d98b336d5fcfd5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180498, "uuid": "a8ae5dd0-a71e-4ff6-8b2f-f856243ebb12", "value": "T13E953AF261A3FEC59B2B1D8480083940EC00696797ACDA58FDCA36BB93F5514EF6C5B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180498, "uuid": "c70bd902-d489-4fd3-a102-95a86bae186a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180498, "uuid": "0626cf06-d35d-4927-a7c3-e6a63c47f597", "value": "24576:pZUeJY2ny/v/LtGZsYjot0d68fKnPTEWuO7KOyOjZa9kfK7V8dhwXlMVUm8R835+:rH2rF/Lq6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180498, "uuid": "ea8e425f-98f8-4112-853c-041c54a68be6", "value": 2042368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180498, "uuid": "869a08f2-9c68-425d-ace6-a8bbc1147b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180498, "uuid": "616a03bd-28ee-4ddf-84b3-f28e040b2236", "value": "DETAILS AND INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9aaad7-cedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680168837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168837, "uuid": "34ec2622-37fb-48a7-84f0-793a17c511e4", "comment": "Malware payload (zgRAT)", "value": "04cad877951c86043088bc0b4261040c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168837, "uuid": "c4f68d55-3f61-4bd4-937a-f7c0c6d40a5f", "comment": "Malware payload (zgRAT)", "value": "d1698bf562afeb9d40e79a3ed0acc152abb2dfed815e0f6d8a91346916815a7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168837, "uuid": "fec1212b-adfc-4615-b9f4-23d064f37041", "comment": "Malware payload (zgRAT)", "value": "f5ea9e202641f24994b558a784a5af0ed905e17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168837, "uuid": "76c94547-7994-481e-954f-797e12fa5cb4", "comment": "Malware payload (zgRAT)", "value": "84b7f05bf6f4f129b94a335133f8aba6948698c74631caacc73ec4b1f6e00758fd19ef1855dea7de2a7b26f7572b6fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168837, "uuid": "c12bf8d5-b865-41ba-bfd5-a41fe7650026", "value": "T14FF4D05F7D1566DEC801CDF2F5F60C046373DB5DE637C237E84A2398A90A3AA8E08656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168837, "uuid": "8fa71cdf-9ff5-4da7-b116-ea295512a543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168837, "uuid": "87b5abcc-149d-498d-ad47-5fdda72d2dd3", "value": "12288:SyH1rQq4EgjtdnKeTSjsh2yp/Czk/37MUL/G9vlSgUkdmG7GwldE:Vhb4Eg2eMsh2yp/7/3wNvoGPlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168837, "uuid": "e86129d2-db99-4391-911d-dd901ee5cd9b", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168837, "uuid": "7401f707-f1c5-422a-a948-71510a9a25c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168837, "uuid": "0f4e5d2d-2f02-4eeb-835e-31ac901a24f7", "value": "P.O#2321-0347CN_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc416d9-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170874, "uuid": "b6ffbf9d-7254-470d-8431-6f783c68b482", "comment": "Malware payload (Mirai)", "value": "a25d99fa43eff35dd6377c0fafd7b4e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170874, "uuid": "6b4e4034-b5e2-45b7-916e-d527895007cc", "comment": "Malware payload (Mirai)", "value": "d268aa86028996a89ce8abb05c82c80cdfcf77637353bb5871956607f2800af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170874, "uuid": "0c97c285-4d3a-47af-995c-f9c702fc2494", "comment": "Malware payload (Mirai)", "value": "c571999da9e96becdb50121d5bb3ce25ed5a3e6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170874, "uuid": "edbcadc8-dc87-4525-8219-5a15689a90d8", "comment": "Malware payload (Mirai)", "value": "b7ff24995c42f44869c74033518eac90e715ea3b76021f65e2c82c24604196432b26454184115cf6decb403c2017879f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170874, "uuid": "7f3d1f1d-dadd-47f8-9038-de9bc3ec40f1", "value": "T1FC633BDAF801DD7DF81BD77A4857090ABA30F3D502831B376397B9A7BC721A81912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170874, "uuid": "4ae26ebb-0f89-4587-a347-ddf4d0eaf007", "value": "1536:3IgNlrNo8t0NDYfRW8VB3a1oxf6P9dJzGLotJ+ChQ8u:3IAlrGNEfRHa1yfy9/zYChRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170874, "uuid": "60404119-fc48-4847-ac23-22b1db2b16f4", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170874, "uuid": "313f0778-86f6-42f7-9a90-015a79b97bb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170874, "uuid": "84c95611-72f7-46f3-9af0-46750f1ff386", "value": "a25d99fa43eff35dd6377c0fafd7b4e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbf8376-cf1b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680195172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195172, "uuid": "178d481e-ad92-455b-b2fe-3539aa5fe8b4", "comment": "Malware payload (Formbook)", "value": "f494bba0b58007a9e24b75710dba0b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195172, "uuid": "e2a8e529-c83c-4fc2-a67f-9f2bb1aa828e", "comment": "Malware payload (Formbook)", "value": "d5c9eb88e84d396ab177225746e25d5a0ea92424e2225371145c2ccddff01934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195172, "uuid": "f485257e-168c-40cd-a7dc-23eeef6d7dc4", "comment": "Malware payload (Formbook)", "value": "89ff3b1b80694a68d93f7bbb5a09991b7d5689ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195172, "uuid": "1e216ff2-24cb-4d38-90f7-6af95688cd0d", "comment": "Malware payload (Formbook)", "value": "4bc130d9d7ea04446ee44a0ce322c53c8ca20ba7478b45e98c534805a7e1eed25244c92b7e0d63c67fa6d390c3e08563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195172, "uuid": "8f8c8ba7-b153-4540-8534-cf6bf9f24641", "value": "T1E115E044BD6239AEF8D2CF3685501E35961477B34217D20782B7289D6DCFAE78A801EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195172, "uuid": "88e11a3e-9be0-4d9a-9188-fe7047632393", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195172, "uuid": "22e5a1dc-f8bc-4fd4-9618-3d1dbf0a85b4", "value": "24576:8jQfj9Oau7BVGLCXcA1MSqmWzFLSK5D+IPZGX:zbyiLURqn4K5iIPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680195172, "uuid": "6f205652-c86e-47fc-9ebc-bc145b6de888", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680195172, "uuid": "45208d01-7a86-4e6b-90f5-dc881591acc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195172, "uuid": "00baaa54-20c4-4653-af4d-5c7c0e420904", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe6bcd6-cef1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680177342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177342, "uuid": "e9de7002-5674-4ae2-8961-860035284268", "comment": "Malware payload (AgentTesla)", "value": "b5c1249537988459774956c23328415f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177342, "uuid": "3034979f-3bd7-4f25-8323-ddec1d8e866f", "comment": "Malware payload (AgentTesla)", "value": "d5d1d16158e09ec1c96be32068355ad3818c43afef21eaa27490b78b107a65f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177342, "uuid": "268ddce6-c9d0-4fa8-8398-391d4d2bb334", "comment": "Malware payload (AgentTesla)", "value": "1b9c88057ce90f1a2b0630b25898d157c2d24a76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177342, "uuid": "bdf1c035-1152-4263-a89d-6555a32ae8c6", "comment": "Malware payload (AgentTesla)", "value": "6ea2305f04d2c01550efce8cadd17b9afef1a15ae5f3fbba876d898e43ad72f003e39b1a94bc05329c6373b7a138f7b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177342, "uuid": "3a25f3e2-8d85-4438-9fb8-a8743f35739b", "value": "T1A7057CA51397AF69F87C6637E6E27F0053F0F6563502C59A3ED10C9EBD2A9801B85323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177342, "uuid": "e0a90986-f775-4fd4-9eee-f5de914a578c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177342, "uuid": "e1ba6798-cac6-4240-9021-b5f137a91ccc", "value": "12288:FGxdYxSbGdHABLqc+pHmWBeMk9STzQUcMHoscx1z80Z9zrF29CW:FddgBmc+B/kiRu8W912oW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680177342, "uuid": "d8cd71fa-25b5-4944-a14d-61e77c140247", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680177342, "uuid": "ddab9f75-a832-475c-955f-a207188e836f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177342, "uuid": "224bc726-cc83-4ca3-8dc8-e79408af21b8", "value": "z1REF-0010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa03887-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680170655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170655, "uuid": "d76afd90-bb7f-47c8-acdb-29a1ca311434", "comment": "Malware payload (Amadey)", "value": "6e6fefb878e0b74019b8c8cfec426cf4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170655, "uuid": "ea765ffb-9eec-4b82-b238-b54c492f1ad3", "comment": "Malware payload (Amadey)", "value": "d5dbda5fcd91459db34c44d1e34cfebd628c729682d44c6ba9c417013dd66fdb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170655, "uuid": "b6639c0c-060c-41ab-8aa1-5d773780d538", "comment": "Malware payload (Amadey)", "value": "478b907954eb5a9d7f920c5bf0d6985c21fd238b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170655, "uuid": "421fdf94-0fab-4f37-aa8d-072a816548ad", "comment": "Malware payload (Amadey)", "value": "ecd6b5403b64b62a1e3eb4ad06c4130cda5ed745e855acf6f311962d82ebfc6140afffb227fee3b822defd5be6be8f9b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170655, "uuid": "d791657d-9fec-486d-a1ec-fb15e4925744", "value": "T19DD633F10770D832DDB22E5775E188B68F62D6E03B1328CDE5228667793ADD35636CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170655, "uuid": "aa8af546-d49f-4888-8f45-a1f61150ff45", "value": "393216:1UYWbfxVew/lHbJghJMSwEpH49Lrjk5Dq:Kbu41aH493k52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170655, "uuid": "1ce743c3-6b90-45bd-a309-ea7c56274e02", "value": 12877492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170655, "uuid": "b9032d0c-bb12-4b38-85fa-9f38a060a081", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170655, "uuid": "875d5be2-e313-473c-9ff0-f4e1cc998a01", "value": "WindowSetupLaunch.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47322d96-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680161228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161228, "uuid": "bb15f83e-eb3c-4348-9ee0-b12bf352a395", "comment": "Malware payload (Loki)", "value": "d4b0d2ad18171a8022e17c01303d357c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161228, "uuid": "020ed83b-d76b-41a7-9e9b-df44a226b138", "comment": "Malware payload (Loki)", "value": "d6c53ee43b78629d88d100efcd2a26c94b98e38f4ed934e50193d5a57337e849", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161228, "uuid": "4a02d180-a9ae-46c9-8f1c-c5f83466f849", "comment": "Malware payload (Loki)", "value": "7086e368fef7205bdde66d1b015369b81e79e2e4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161228, "uuid": "f558b3d6-89e4-4eaa-9dd7-39ac87715cd5", "comment": "Malware payload (Loki)", "value": "42c4d4423507899b29505d31ca55ceaa11a02f87b9819f9f89b400fa5fd98c823b9f84e56b02bd69fe32d0a16abdb0c4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161228, "uuid": "15ea9b37-b1d1-40f9-9719-32531ee0859b", "value": "T100D4029036DDC01AC626837A82F4C1B02779CCD5DA79CB931FCABD9BB3CE34A5521196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161228, "uuid": "1b325c43-0102-4fc7-b4ad-181290cca73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161228, "uuid": "0aea4ada-5fd1-44df-90e1-6634740018a0", "value": "12288:seJ/sIKw3h8lXvIcAkVk+CAZogRSWTvuu9VLN5jXbimOMt+X8:hKlXH3rCWogT2ubjXbimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161228, "uuid": "9a1a5182-e4f9-40c0-9a80-74f78422da2e", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161228, "uuid": "f8e74bce-f9b4-43dd-a131-d941c52be3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161228, "uuid": "4953b130-c262-44a3-8ae5-a4ef5411b91b", "value": "DHL Express_95512656186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8583f2d-cedf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680169605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169605, "uuid": "cad64dc7-79ea-44a3-b5ec-88e61c41a1f3", "comment": "Malware payload (AgentTesla)", "value": "e399967f344f4ddec61d6f1e60a313d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169605, "uuid": "e9c0fb4c-7f8b-402c-bede-b845970fc384", "comment": "Malware payload (AgentTesla)", "value": "d6c546c30a81e6e73411e37ea4379e329ae218b9614b4bd3ca878148d0749dd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169605, "uuid": "d4ff6faf-e61a-4672-ac17-2fb21983c37e", "comment": "Malware payload (AgentTesla)", "value": "aa5f796682d7f2366f941dfbba5801f61af26c80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169605, "uuid": "4d027e29-aee7-4104-bfde-74c930d37a5f", "comment": "Malware payload (AgentTesla)", "value": "b279546a1a32de5f8ced402f3054d2665307010543c424c6b08104a90f2c51c39bac482ee1e321e6a1d40907a0563a00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169605, "uuid": "13234b63-08dc-4605-ba55-cf1dfa20a1eb", "value": "T1C8F402292BEE6139F43653BD899435955B7E33B26713C85D18F212CA4B637038EE062F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169605, "uuid": "33baf6ce-b6e3-47ba-abc3-045949051095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169605, "uuid": "d3824536-c377-4a32-88e1-d19477375621", "value": "12288:5HrmYMUnFW/NGbab94ZAda92D67NUoSeFgFDF/72reKSXXT4GfS6ffRilcy3EZ3s:5HrUozZWa92DAUo4Bxaqzx/ffRilhEZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169605, "uuid": "e1f30701-3e46-4ab7-b8b1-9eac61b310c5", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169605, "uuid": "0981d36c-6dbe-4ed0-8771-0f360a9b56e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169605, "uuid": "739cc8e4-1c89-43b4-a279-e60786acb720", "value": "Shipping Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6830a59f-cf0b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680188341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188341, "uuid": "5debfc95-ec86-4573-ade5-a68fbbc59364", "comment": "Malware payload", "value": "47b44d9ae55ba90868a3be142c0e1ae6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188341, "uuid": "9dfd48a0-1664-4e1c-a87a-2771f3be709a", "comment": "Malware payload", "value": "d70a789ae764c40fa7c54ab453d1b7f88bd3796ded95cb47d41092a2625638d8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188341, "uuid": "d756783f-7922-477b-a094-6b006148f3a9", "comment": "Malware payload", "value": "6cc294732b213d908c788ea503b509c670bedf11", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680188341, "uuid": "f839d5df-d650-44e3-80ef-635b14dfb3c6", "comment": "Malware payload", "value": "fd7df18eb26a9dfd11f97f4535d00767516b7407883324f877baebe15bcda6bab15fcbf8468ac13d2d33e580cb6c0faf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188341, "uuid": "c87e72ef-9685-4e42-a78d-5c7c2425a21e", "value": "T16E23745A2CD03E6130064C7D990B483D2A7A38763A6861605B7F97F49DB59DFBBA3C0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188341, "uuid": "a49c5087-9c67-4167-8896-ea28bec3e1d2", "value": "768:KmcRuiEO3lgCDPRykEY/ZGaTJB3aTsCBlN87rARA8bDhfqj0GO7:DcRJEO3lVLEY8aNByBw7sbDdqj1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680188341, "uuid": "99d2f336-1e63-47c4-8607-dd2785508d17", "value": 49039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680188341, "uuid": "65cf655b-238e-49cd-b4ea-cc0601fcda03", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680188341, "uuid": "d6452373-d7ea-417c-b0c5-e12b8990df97", "value": "OCHEMBA400.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cf237b-ced5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680165339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165339, "uuid": "15d609fb-d3b6-4367-ac73-076a3a2b0e5e", "comment": "Malware payload (AgentTesla)", "value": "7656a050fc6ddda4165796b5e9717b6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165339, "uuid": "95e86e0a-adbf-440c-8aec-ff647d29b418", "comment": "Malware payload (AgentTesla)", "value": "d753be542efc0cbbe9e369218829b48047251597711533a84c3d2f90ae8fcdc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165339, "uuid": "2cc6ef38-3774-47a5-bb2d-24fabe15f631", "comment": "Malware payload (AgentTesla)", "value": "3a64aa27b0c23f9ea71b05db87081da896f471d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680165339, "uuid": "2ad0c13b-10d7-4da2-ad51-fbb1236a21a6", "comment": "Malware payload (AgentTesla)", "value": "a19f677667e4050cedffd2944ffee14c37b0b53c9b405f6109aff29d56f646bb75a3474ca0313173255feaf8d2639362", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165339, "uuid": "4dfb26f4-4242-49d9-91e2-94b104b07544", "value": "T1DCE46DA77643DDAADE58C6F918A5F6BC329069D42F506A4DF20821C70CB933CDC86F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165339, "uuid": "b1354314-49ae-4a14-bf2f-fe1d94f4a8d8", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165339, "uuid": "28f1d86d-2988-46bf-bc66-36962d05c4ae", "value": "12288:RXbA6dvFFBKa7ofHS2A168u36ijLH8aM9Wav3m/ftQXrU5GB7HDgtksuC8Jisp7:RHvFFMaiHSTm6ijgrWavitQbUwRfsuC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680165339, "uuid": "4cb03112-c5cb-4bed-89d6-a938d8778c54", "value": 698488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680165339, "uuid": "d4ffe450-9129-44bc-acbe-56f5f230ec69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680165339, "uuid": "0beb0da5-8d75-4fed-8db5-71c5479ffbbc", "value": "PO#026474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03efe6e5-cee3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1680170993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170993, "uuid": "fb191189-799d-4483-8db1-fe92bceae5cf", "comment": "Malware payload (Quakbot)", "value": "c9ab1cd04e796fd7f084a1dd2d40cc2d", "object_relation": "md5", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170993, "uuid": "670425a6-0fb5-4cc4-a29e-631c9fd57500", "comment": "Malware payload (Quakbot)", "value": "d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa", "object_relation": "sha256", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170993, "uuid": "2290e057-2fab-4780-8c44-10bbc7fa2bbd", "comment": "Malware payload (Quakbot)", "value": "f05b2066a375a5c8d3dfc44d6097f577cd4f0255", "object_relation": "sha1", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170993, "uuid": "9bb78339-51e1-45f8-b566-253552523130", "comment": "Malware payload (Quakbot)", "value": "8b3859f4c7b268582a16051e47ce90cc88f6ad82310974a6e8cdc72f055ba75fa0cfcbdce8671303e0506991413b62e3", "object_relation": "sha3-384", "Tag": [ { "name": "1680106938", "colour": "#55AF86", "exportable": true, "hide_tag": false }, { "name": "BB21", "colour": "#DE1725", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170993, "uuid": "96f4fd44-a775-4cce-bc5d-051ec85e6339", "value": "T12AC47D29E94295BCD91315F1A89BFFEF6324163549288C9FE7280D4DBFF0970910BB29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170993, "uuid": "6e97eb16-0a9e-40d2-a427-94d049ca1796", "value": "12288:0sqXe4DNX3lWA38yEDJQTiaQS8LztCYKH5t3XjMjDW:vqXeSNX3lWA3DEeCLcYKbIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170993, "uuid": "8f43afde-081a-418a-8386-094e93c79e0c", "value": 570294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170993, "uuid": "d48cd789-4c53-472e-88fb-b1909c872d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170993, "uuid": "f5db2150-6b8b-4d82-bb1a-5ff4f3b8f50b", "value": "Beinked.Funkias.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e71ead3-ced0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680162931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162931, "uuid": "388abdfc-7394-429d-9f62-0d1023e96ee4", "comment": "Malware payload (CryptBot)", "value": "e4e8905cf218c3e12f9fccbf4a703744", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162931, "uuid": "db0fc223-0c0d-4359-a784-0598022f1efb", "comment": "Malware payload (CryptBot)", "value": "d80b49455c86bb748c2b4d006443e73fb107f4cdfee298991bb526bf9a6fa464", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162931, "uuid": "a91da917-8621-427f-8c26-34d4a5140ff0", "comment": "Malware payload (CryptBot)", "value": "4b3346a3b4e6188631433e5c1601e8bb0ca2f798", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680162931, "uuid": "7d0743d9-6013-4a6b-9182-cd79c63e1732", "comment": "Malware payload (CryptBot)", "value": "1d76a33491dc5cf611a7bd5aeae57c71c5d0fd1885537bb405030503a6a424ed6ba842c695ab06a8fcfe6f3934f63def", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162931, "uuid": "55222768-6e6d-471d-ab9d-7aee90f102a7", "value": "T1D96612F2F2949816D2938D747A6FB890E1FB3B0607818A3C749E7AD813B7350714DE96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162931, "uuid": "6f23bb27-74d5-4479-b8cf-8cc8cf706e28", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162931, "uuid": "63569d5c-3572-46df-8591-2550eb9f5a48", "value": "196608:FL7u7L7uo4QIyIUEkPYWiDCRRAsRnWODS9v:pqLuoNUUdPcDgAs0lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680162931, "uuid": "a6f852b7-3c4e-428c-856d-caececf5960c", "value": 7078400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680162931, "uuid": "1ff235ad-17f6-4b0f-9682-f704adffc6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680162931, "uuid": "3746fd7b-7e07-4fa9-a9d6-a12a51d4f888", "value": "e4e8905cf218c3e12f9fccbf4a703744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d447c6-cee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680170842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170842, "uuid": "254b127d-b17a-442c-86aa-75b06eb0ffa4", "comment": "Malware payload (Mirai)", "value": "8f00319e2c1b2e9fc083d5168cfe7e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170842, "uuid": "42af125a-0499-45f3-bfa8-5db85fe32700", "comment": "Malware payload (Mirai)", "value": "d85be370bc4ca270206213e74e284a6c338a9d921d75f41f2bf869c163f8e522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170842, "uuid": "314887b5-a8f2-437c-8750-3ababefbbf58", "comment": "Malware payload (Mirai)", "value": "9c4cb191a854b215cb8b6b95e88a4459acc3fe65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170842, "uuid": "65f73fa9-8fae-4ca7-b16e-b47b2c8cf2e2", "comment": "Malware payload (Mirai)", "value": "0801edb22b55546d2da2cd3284bee4a2210a4fc627e791c214856cc8b7c776931f6542266b7097d23ad7619d0bdecab6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170842, "uuid": "26772e47-6252-44c0-8c3d-f48230c4c41a", "value": "T192631851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170842, "uuid": "0d5cbc1f-90f5-409e-ba6a-23ea06da9ab5", "value": "1536:PNflxbmiiFiLHzhd/59iCl0BlhSGwifwX2vbWM:PNd/5wK0BlhSRQ3bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170842, "uuid": "1058da8e-5ec6-4ff5-8fce-fa0b303f0c09", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170842, "uuid": "f27812b3-a355-4f4d-8650-50e0cefc5e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170842, "uuid": "980ec2b8-71e8-4d84-881e-d7743a6bad6b", "value": "8f00319e2c1b2e9fc083d5168cfe7e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a6c27e-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158376, "uuid": "f6383928-ba28-44a2-921f-767494c961dd", "comment": "Malware payload (SnakeKeylogger)", "value": "173f8057e4b607dbd5aa929fb3a83988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158376, "uuid": "f965a394-29a7-4d08-8a6c-bf7c8b841370", "comment": "Malware payload (SnakeKeylogger)", "value": "d8e945322322e348f8ccd15cd7eb464b39f45664d831aa368398e64461869d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158376, "uuid": "b371017c-a5f0-456c-9c4e-97d3e9bdb7d6", "comment": "Malware payload (SnakeKeylogger)", "value": "50c5cbe3c9c22cf78b8ac34cefa5ddced659416b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158376, "uuid": "a0b839f5-aff9-4e4f-a5cc-49259fab4928", "comment": "Malware payload (SnakeKeylogger)", "value": "3397bf2bb8adc1fddbe3f2707c8ab5c6e8ecec5a14f0648d336f2e6cffdaef875c26463e0d986ca71167492d24f668e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158376, "uuid": "01a0cdfc-39ad-41b1-9315-bf2224c4eb92", "value": "T1C5D4015036ED811AC666477A81E5C2B01B7DCCC6E669CB670FCEBD8372CF386562016B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158376, "uuid": "65f7b0d4-d836-44cb-bf9c-8a6e27af9d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158376, "uuid": "5150d868-00f7-410a-9e67-baa173381e52", "value": "12288:AeJ/sICy5zhZZvkoXSslYh8eCmE9gK0FaRRMcRhWjabGgimOMt++:5VZk0Blm8eFE17hRhDimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158376, "uuid": "01df9c7a-9fca-4923-8b2a-fe487bdb1cc3", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158376, "uuid": "b4f5f874-b0d7-4ff8-92fc-63d9ce0a47d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158376, "uuid": "8bfef30d-fc51-4bdc-913d-0924773f37bc", "value": "173f8057e4b607dbd5aa929fb3a83988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35446703-cf23-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680198564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198564, "uuid": "dfdf69ef-8aea-49bd-8176-2d2b82b02ebb", "comment": "Malware payload (Smoke Loader)", "value": "d984231b068cb9a3b6e0cd0dac00d5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198564, "uuid": "83920ea0-1a98-4190-ac2b-a0b40a51ea6f", "comment": "Malware payload (Smoke Loader)", "value": "dd325f203871fc329de167912647075a4d9d7499ea801eb153903defe3f364c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198564, "uuid": "9bc32a02-7960-4928-9324-24f5c603ab52", "comment": "Malware payload (Smoke Loader)", "value": "b325e602ee57e718c21a9859af60fd12bfdc9cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680198564, "uuid": "b93b7af0-f850-4c63-a648-02df067140e4", "comment": "Malware payload (Smoke Loader)", "value": "c9b059ac5e5c0df75fdb7a41651564959bbb70ffd26eb2d6b869e1a2e7faae8b4f1bf3a6e803ed76d1ffbb0e276c77e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198564, "uuid": "7ae9a176-d75e-4976-8767-1829933d00a3", "value": "T1D9246C069FFC7871E52347368F2EC3F8261EB861BE15BF5E1659992F85B43A1C222311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198564, "uuid": "9f4def70-5bb6-4c9d-9e25-fce2ee8b2de6", "value": "623ff25e9281d73ab450cd45608b6a86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198564, "uuid": "b95eaa88-52d6-44c7-931e-0dc9d5e63793", "value": "3072:yPxq851s/KYnCfjo5/RmapM/n67jPclVx1lXIn8FgC8Udt8lBrnLcMaTrT80:OrMrnC/I7wRl/Fz8UmBkMaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680198564, "uuid": "859e17b5-8540-4441-abea-6c801e0e46a0", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680198564, "uuid": "6e6b13bc-df06-4aa0-b3a6-06670228ec8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680198564, "uuid": "f3eeee3a-606f-4ca4-93b0-587d78fdfc9c", "value": "d984231b068cb9a3b6e0cd0dac00d5cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cf99f1-cf2e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680203564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680203564, "uuid": "ecc3c510-cdc5-4c11-9cb0-bf7d10b31a28", "comment": "Malware payload", "value": "c63f706a6c1d3828e3a4023d61df221b", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680203564, "uuid": "f2399211-6edf-470f-b92f-287c1a966a1a", "comment": "Malware payload", "value": "de843dbeab51c105faf10618f9e3a30deac6279c341e99f32bc5032cc0ef4ae5", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680203564, "uuid": "eaa7e05e-6fea-46bc-87b1-e69005b5fef5", "comment": "Malware payload", "value": "719068187a45f76f30dccdc840b71079327e9ad6", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680203564, "uuid": "84e22dc0-d82d-4c10-9b30-fea2ff5a734c", "comment": "Malware payload", "value": "de8c713bd323df1d3de68401e4571a1dcc7471716559c8dd8cbb75a528dc2352efca6928b5419c069899b5828e0d6799", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680203564, "uuid": "b7e505e0-339a-43dc-9296-ea3c52c53c60", "value": "T1C7B3D8A968469C2302BFAB766F467A89F825516B4A40518B3C7C73CC4FF847681F1FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680203564, "uuid": "826a209d-be61-40a3-8662-5ce111734ffd", "value": "3072:LO4DVFQoQoSGdq3W53LhpvNHgvFNSjb3k:C4Qboq4Av2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680203564, "uuid": "b17ffc60-8e44-499e-9484-d21d55e64590", "value": 108814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680203564, "uuid": "1c0c41d3-3e25-476b-b2a4-4393712afe0b", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680203564, "uuid": "1f6c58c7-df78-497f-8abe-d6aec76acbd7", "value": "bKDc.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af468e00-cf28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680200916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200916, "uuid": "9031eaa1-ee77-4ff7-bf80-77077fd5cf27", "comment": "Malware payload", "value": "22dbe256c7582106b7825641f3d29d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200916, "uuid": "49e90259-0456-4c97-b259-192668090d7f", "comment": "Malware payload", "value": "df86cd16a3008dba00590edae31d1313bd92528aca92c4f4ea7f24000ba62547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200916, "uuid": "b19d572c-0e57-4499-a0de-089c8c99cd26", "comment": "Malware payload", "value": "0e3853bab5aa68293b1275f3c87df975ec45fd49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680200916, "uuid": "2dd2b9c5-0807-4cbe-abe0-69ec240a5d4a", "comment": "Malware payload", "value": "6a06535a89786ccdcf7ad7ba71281378f74f086da376aab266f7e86ca751d77b5e135414eba822749965321cc572851a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200916, "uuid": "c14aa8ff-f12b-4450-a85b-9c68acc77f4a", "value": "T1FED65C17F8A204E6C2BEE1348556B222BAB134A583307BD72FD499AE1765FD4773E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200916, "uuid": "a7a518ba-7426-4e8c-a2c9-18ce1f574dcb", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200916, "uuid": "9ac295d4-a46d-46d7-b0fb-0b6cd10398dd", "value": "196608:bC4j8aIk6cQB4OIL2puFnXlsALGzJ0NIPvxudoq2k0x:lMkoKCwEALGzJ5vxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680200916, "uuid": "f167fae5-bced-4181-b034-444f9a6a9b32", "value": 13348352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680200916, "uuid": "27c4c640-efbb-42ca-bd13-e66aed23c034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680200916, "uuid": "5708c447-fcd5-4cc8-a097-6d63b7514bec", "value": "SecuriteInfo.com.Trojan.GenericKD.46005591.18068.6340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3e85c2-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1680180721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180721, "uuid": "34f693ae-80ff-4eea-889d-17f23f48d8c4", "comment": "Malware payload (Gozi)", "value": "395a350e53cdb5c9afcf01b0031a576b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180721, "uuid": "9260b66c-f037-441b-950e-f30f9a0030c6", "comment": "Malware payload (Gozi)", "value": "dfb911484ac598d7da09fecaf4f870ddafbc354661fb2e6b03c2202c169c1e2d", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180721, "uuid": "c5b43c28-9ffa-4240-a55e-f893da0b968b", "comment": "Malware payload (Gozi)", "value": "1352143ca7f0248e560a784701bf763329595438", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180721, "uuid": "4ec0e943-8826-43c5-8c87-abde23efdb4c", "comment": "Malware payload (Gozi)", "value": "5062b588736afe535c52faa7bbf5a86cb7b3c448af6e1e9af4cb42adf9b4ff0a1629e6d993d3148f2429fde2ca3658dd", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180721, "uuid": "2dcf4326-e93b-4415-93b7-302eef23a867", "value": "T1C2E17DFA6DF4696B25F5B1BE6D115D0E501D0C220A696CE6D03CD4BF282CF46B8B640B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180721, "uuid": "fa4358be-24db-46ee-8d8b-900380ecdb4a", "value": "192:VGluiq14L2xcOLdEw9gsoo+VQYw3C0gcHfTZ/D03sE1S59e9Tb2v8Yoi4+LMi:HKsrz5E08TmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180721, "uuid": "ec1713f5-9c41-4efe-83d8-366b4d6950df", "value": 6862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180721, "uuid": "de33729b-144a-4ef1-b8cd-fb4d5a970aa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180721, "uuid": "81fac7f0-1e00-44d9-8661-c9cbe2555584", "value": "4_2023030227067009.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdb8fe6-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1680161665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161665, "uuid": "78b2d8b6-302a-4b6f-9ff7-c6daa61d77f7", "comment": "Malware payload (PureCrypter)", "value": "eebdd5b69b2fbe296a4e848b6ece83e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161665, "uuid": "73596e3d-d435-456d-a0d1-8c6743f10273", "comment": "Malware payload (PureCrypter)", "value": "dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161665, "uuid": "22259a47-f0d3-487e-996c-35faa8378d65", "comment": "Malware payload (PureCrypter)", "value": "a416b80860c5810aa92c72382eb34c29a36ad34a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161665, "uuid": "892bd712-7e5e-4c89-88d6-ba5013b96575", "comment": "Malware payload (PureCrypter)", "value": "f690e4866efc66f1fd58cfc021323c4b265ea3173e7a0fcd621f9f218b2a016695f5385b642b17bc93b31a397a4835fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161665, "uuid": "9096f0ae-2c19-4a41-b585-7f886260db2a", "value": "T10F93E7496FACD6A3E1EE47FD44B2821103B9E15B9202E38F2FD404D58D667465C32EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161665, "uuid": "9887726b-4c21-484a-a5fc-c4af96f6a999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161665, "uuid": "5faa1c1f-f279-43f1-aea1-5a7b1235184e", "value": "1536:LgBV6YZ3juIBFXJpk+CfZxtLOgiC2fjYYYYYYfpQpQpQpPd49N7H:UBV6KTBBFXJpk+CfZHLO1zfzpQpQpQp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161665, "uuid": "3c29e93b-05a3-4091-ae52-af3aa55e3477", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161665, "uuid": "15d4f851-75e4-4e75-909c-3252ee5bb8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161665, "uuid": "2fa8511a-00b7-46c3-9409-12fdd991a7ef", "value": "eebdd5b69b2fbe296a4e848b6ece83e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc92854a-cec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680157989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157989, "uuid": "ea154779-7182-4008-aba4-0d3cd44fc6c3", "comment": "Malware payload (Stealc)", "value": "ceb62b6ac343ec808a818267e0ef4f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157989, "uuid": "9d0ab914-9e9c-4238-a245-9178ce321a5a", "comment": "Malware payload (Stealc)", "value": "e08ffdbd935971d2ad62d3ecdb736d34302a230485de662a7f6fab81f39df48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157989, "uuid": "aa47dda7-b7f0-4d97-9905-d457faf43198", "comment": "Malware payload (Stealc)", "value": "d936107b1ebd5afe7c61db40c651c583b8b58487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680157989, "uuid": "6697c138-7cf6-4f17-8e33-9d693e5d89ac", "comment": "Malware payload (Stealc)", "value": "9283ffc752ef5cd54678776efb9cd19b216269b45358b1816923a07c6c0469dd0fcf4950628953e394dc4d7e3fd365ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157989, "uuid": "877d1432-d69f-4709-869b-ee367845bc29", "value": "T19A55A409F0C4DEB0C789413A334DCD79E598BA712E16E956FBD2A35F0A340EA560FB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157989, "uuid": "cd966a37-8943-4aa4-a47d-dab79f1be019", "value": "93aecbb81928046ce9afe4c7ab7c1d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157989, "uuid": "534cf89f-3a76-4ba2-930f-f48b3a0dcbb3", "value": "24576:pYEtXdWl96ju5KGkcIGFI+kMixFDEHq55LOw:/Lg4sKG/IGFQXxZf55Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680157989, "uuid": "2ef70958-b84b-42c3-9ccf-91efc631e322", "value": 1312192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680157989, "uuid": "f1c62a6b-fc12-409f-807f-e1466b1963c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680157989, "uuid": "037f6b33-5bc7-4da7-bfa4-98df504d5b54", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef77456a-cf06-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680186421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186421, "uuid": "eb8c8784-2c6a-43ac-9f25-06bbcb34afd5", "comment": "Malware payload (Guildma)", "value": "cfe202b44911fa31c8e4cd5d87a3034c", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186421, "uuid": "072724d3-a75c-452a-b0c3-612790df2616", "comment": "Malware payload (Guildma)", "value": "e0edac790fe7ebdc629d3bd6e55fabc989ad9ac45285fd9f9574d21a23a397a8", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186421, "uuid": "84c1c944-507e-4168-936d-528926cc7247", "comment": "Malware payload (Guildma)", "value": "14e487c77f5d82aba296f709dae10a7504492b2b", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186421, "uuid": "7aad0638-bf9c-420e-a168-9e5fd0844d1b", "comment": "Malware payload (Guildma)", "value": "d98d822ee6d80ace5fce909676b8f3ff45c0e3660012c22269037540367cbb141729c0ac4928faf7c6bac36d5c85939c", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186421, "uuid": "1aa188e2-126b-479f-8434-cf8f956aaba6", "value": "T13DF0AB9DF0512F9DD1AC11354C061B854DAC390B0B8D72830B8E26A44AB898C3A1F360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186421, "uuid": "88d1a891-bc28-4808-a055-682c8409320d", "value": "12:8rflM8OBE6ZGZgkht4jdzbMLFOmrnom7f7WM64jBh5p9dq:8loGZFL4ZQLFOCom7fXdTrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680186421, "uuid": "940ecf61-f564-426e-beab-1b394d75bcb0", "value": 489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680186421, "uuid": "65bfc4da-0a47-4e1d-9f07-90a76bd4586a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186421, "uuid": "18386adc-2bcd-4ed3-9306-707f9c342ed1", "value": "29_FLUXO_PROJETADO460.413158.79947.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a78322-cf09-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680187498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187498, "uuid": "6c76299c-10e9-4902-b04b-e52d254c30a0", "comment": "Malware payload (Rhadamanthys)", "value": "af1e08146db86e6f4fe5e4b2cad1f497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187498, "uuid": "5aea60b8-01f8-4ff3-9584-cd58b84076b3", "comment": "Malware payload (Rhadamanthys)", "value": "e1155e205a493c20a6fc56c104416fe3fac2c8a14e6f6a218078318bbcac4f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187498, "uuid": "be59203b-556a-4776-8ace-f2d22e03bde1", "comment": "Malware payload (Rhadamanthys)", "value": "bb37ce758da5e09b0afe62e4e102b29d7e0867e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680187498, "uuid": "ce1c315f-504d-410f-bcd9-ee778f993d37", "comment": "Malware payload (Rhadamanthys)", "value": "95a4c4767337e5d1ef3ddb56e9a5d75c21e548fcbc0fbf4c8883b45b0086d4a239c7ad6ba9a2049272e97afd3cd6c36c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187498, "uuid": "47b6f963-8ca0-4df1-bcd8-692ef58fc873", "value": "T14F549D129EFC7830F62346368F2EC3F82A1EB4617E15BA5D16559A3FC9B43A1D322314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187498, "uuid": "fe1da9de-5323-4b87-a43a-bb261cc1f19a", "value": "be8fda35a838774ccca2fa79eb32032a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187498, "uuid": "6ea6bda6-4954-4bad-96d4-18221f451940", "value": "3072:VRY9m3wSfi2C14qsnEqFqOb/8QaVBcH4gRMdHe6xrY5/+lXuebmghSfrbxNycuan:nzA+m1s91MY5JeygsfXxcmlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680187498, "uuid": "c2c6f26d-7466-4680-93b9-df9f2cfa8136", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680187498, "uuid": "de91c547-a949-4c72-8f1a-d15b936aacb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680187498, "uuid": "42240249-20bb-442a-93df-aa447308b49b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94055804-cf05-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1680185838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185838, "uuid": "cb0da945-840f-49d1-8159-85e525df39f1", "comment": "Malware payload (RustyStealer)", "value": "822d385ffc321a4e9042ecc11c7b46df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185838, "uuid": "4095a973-525e-48d9-945c-1dac0f85f47f", "comment": "Malware payload (RustyStealer)", "value": "e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185838, "uuid": "dc02a704-ac41-4d05-b9b6-ec55267b9446", "comment": "Malware payload (RustyStealer)", "value": "5cb4f113ad2c4fab27d9ad101b5a3734d1764aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185838, "uuid": "1aa4996f-418a-4ced-b6aa-40310bc6104c", "comment": "Malware payload (RustyStealer)", "value": "6186af24a21e91506db870d6c17ee1de7e9483ec203d7bf02601a5ff92f5573e03699c87b4e6cbfaa7aaa27e9e005282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185838, "uuid": "aef526be-c470-4d9c-9c1d-1b3b7e016648", "value": "T1CB268C43F6A442EAC0AEC175C6579223E772FC490725B79B17D48B222F23B606F5D398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185838, "uuid": "6ee55165-eaaf-4e9c-85c0-b5e528fa806f", "value": "9794d6f5590d8c517c92c6b26d876d6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185838, "uuid": "e5355b26-ed72-4dbd-bc75-3d6ec0b9a0a0", "value": "49152:H1gF8jnXMJQbkaMB79ls430YCAV0BGiuvLoxbKKMpHpkx9dUIPcTm:V4Z9ZpBQY9IP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185838, "uuid": "10a79aa8-915f-4571-b388-f1fa6f1b32eb", "value": 4503552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185838, "uuid": "111da3f5-30be-4491-9d8a-7d9ce462c3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185838, "uuid": "f3d29d0e-9f58-4715-8b7e-c4d62083a8b8", "value": "e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f39259-ced9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680166942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166942, "uuid": "342e5f11-eb64-4b47-a813-6ff281cbef51", "comment": "Malware payload (Formbook)", "value": "f2c35d77f574b27ab812bc9a410648e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166942, "uuid": "0df19a10-7e70-476b-94db-21b29b8cbf19", "comment": "Malware payload (Formbook)", "value": "e29c4da2ffb29da2ca94953e638058674b6234ac0c75864d644a661d582a3ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166942, "uuid": "312ce8a0-fe94-47f2-857e-ec96b56b2007", "comment": "Malware payload (Formbook)", "value": "c1f1bb995f6df67f42d763f6dc46e987d65bc1d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166942, "uuid": "1dab050b-17ed-4653-98d6-8a7733298e97", "comment": "Malware payload (Formbook)", "value": "d83d7f4b6709ef1426eea7fc97d16b5c97024d290039d11e06863b58c10df251cb66fd3f4e9c02b74bb185bf6dc5c684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166942, "uuid": "fd14ede6-0179-493e-aeda-f99f68b3aa5a", "value": "T16B5412416791E1B3CA53103D1F37CBA78BFA1263047A53975750BF5EBA2A5C0EA2E390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166942, "uuid": "192fcf66-6e04-47e4-9b98-25bd3780c499", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166942, "uuid": "58c25d1c-d0e8-44cd-8008-767124faf0e9", "value": "6144:hT5UzmVvNuQ1Gc0NMWw1fH3DmmZUCbx76o7Aa2t6165J+ePEWGipfk4jX7Y:hT55VvP1GcJWszlUCb16o75a6+MeP/+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166942, "uuid": "6661b6a1-8521-4206-8b18-4504f4a6575c", "value": 305007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166942, "uuid": "890e4d8f-3b7d-4dd0-8472-837c06d5e3d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166942, "uuid": "ae64fe43-24fe-451e-a137-a15c103b6dfa", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad8fe1a-ced3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680164428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164428, "uuid": "9212223a-292b-4e65-917b-59a99daba2d9", "comment": "Malware payload (RedLineStealer)", "value": "3b516b28885da12f99d8a89f6cadd8df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164428, "uuid": "ce21b605-5693-4692-b966-bb5657e3235c", "comment": "Malware payload (RedLineStealer)", "value": "e320aed31234c7a5728eb455fb69396a40c6235422bfa40beb6ef0769362d857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164428, "uuid": "e124ba0f-27f7-4dfe-b685-72ea4e601986", "comment": "Malware payload (RedLineStealer)", "value": "78d4a93df52eedbb5844560aaeb5d57e7cbfd354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164428, "uuid": "8ac71aeb-071d-4924-9f10-dd3982a22020", "comment": "Malware payload (RedLineStealer)", "value": "946aab92814df5497f7e4a1f2a70ec2db3e727aa2f1c3073d7982e8f5c6fec08a400b244dccb7ec052c3c02d9440403b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164428, "uuid": "59dbc18a-196b-47b6-9a6c-7d4517da6fb6", "value": "T158252346BAEC5032D4F5633018F903CB1A36FD6159B99BBB3B40AD6D1CB29A4E136317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164428, "uuid": "56c8cc8d-6572-4b32-bbd3-097bcbaf4019", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164428, "uuid": "5e6d196f-4177-451f-9632-21a3bee86a6c", "value": "24576:zyXfmxtKcwI7eOR2Y4g1c11s8cgDwllqqoZrtbBi:GXfGK5aL2Y4gy/x7DwHqtZrtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680164428, "uuid": "7c2ba87c-998e-4e0e-97fb-5572140568af", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680164428, "uuid": "eb315405-8b97-4961-b795-8ed6c2a33f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164428, "uuid": "92cdf8f0-5d07-47a2-b0ed-e1c04200837e", "value": "e320aed31234c7a5728eb455fb69396a40c6235422bfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cd2d90-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680160928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160928, "uuid": "4798f78f-4ae8-40eb-9c1a-3436d1e1a18c", "comment": "Malware payload (Loki)", "value": "d5cc0199247025f8b7c7be916e9d12e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160928, "uuid": "87a37ce6-fac3-4605-b3ae-e9cd774bb893", "comment": "Malware payload (Loki)", "value": "e4b9cadb865b6821fed44ea24bfb2968208aa56b2a0a76026d18d7d594f58c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160928, "uuid": "6c42bc73-d9ee-425a-afd4-d1b5f91556e5", "comment": "Malware payload (Loki)", "value": "96a1f5651127e509d559591d98e6fe8ea7e60738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160928, "uuid": "69159115-ca8a-4057-80a8-a40b1473c50e", "comment": "Malware payload (Loki)", "value": "5f110723e685f8dc824d0b80e6d42f9c0a866e368d58e7d5ed0a889c773b84f0a3e5e7b2c284483891bff47cc2d55a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160928, "uuid": "f0fa7522-37f6-4877-a1b4-35b00e6c8724", "value": "T120D4D0A6720098EFEDB60AF148A7CB1516783FF5D8E2202F77CDBA2D24B37520517916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160928, "uuid": "b8f30a81-8ec4-41fd-a161-99a87f78e15e", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160928, "uuid": "ee779ecf-ddce-48eb-9ca0-b614c762bcc1", "value": "6144:R92Nj7FNKuggE/ZsIMg+Emf5U5+G2DLZJVjX9+V/+DAOMOnZigebdhNbG1ikKs3+:nsxu2DLZJVLIV/InXe1bGwkRo7hhhSB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160928, "uuid": "5674287c-66c3-4ec7-8658-49659e7d17b7", "value": 607684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160928, "uuid": "c0f738ca-d136-438d-83a7-06061b8f8426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160928, "uuid": "011f4fe2-c95c-4fe9-b110-10ad1890e64f", "value": "quotation_3246uu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65f7c5f-cec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680158086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158086, "uuid": "4882e43e-72c9-4a57-8c6e-fe3acd3f69f2", "comment": "Malware payload (CoinMiner)", "value": "ed26d7818becb7d1d6f2c817341611aa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158086, "uuid": "17984bd3-1fac-4dac-a4f1-fdb85f098552", "comment": "Malware payload (CoinMiner)", "value": "e5ddc31d2c92d19cb412602f4d9ad66144d509f66bbb770f610dab1ecbdd05c9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158086, "uuid": "db38aee2-dc85-4b51-a690-37c899cc8a6b", "comment": "Malware payload (CoinMiner)", "value": "99b298a20c039b5310751caf6804c04a266286dd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158086, "uuid": "216cac29-4fee-447e-95b3-8329db3b63c9", "comment": "Malware payload (CoinMiner)", "value": "a4895f8b9327f8a544f035993520f0568ec9639f5c5dc31bd08432516b2086326cfb20a49247bae5313ae370245dbfb9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158086, "uuid": "f4ce41bc-8d8d-4d65-85a4-24cf27d7d79f", "value": "T1581633C1FB35604AFC07D6391086678BF73AD91CC183909B3ED55B364C4DEAD8AAA6D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158086, "uuid": "d8196aa8-7ddb-4f40-bfa2-9092d7793ac4", "value": "c1f9ea6d51ba4934aeaee8b1f7d283d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158086, "uuid": "9d6e7463-2b4b-475c-9410-06f586792803", "value": "98304:3nyEcfLLDXXlvsSF9oBi0VSz2XIlehHUFjXW6EXc2QtlYs:3yEcfLLDHlvPF9oBiNzKSehHUFTW6EXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158086, "uuid": "df07a500-44bf-4165-8a42-4c180ddb93d0", "value": 4039413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158086, "uuid": "d78525c9-6e01-4fcd-8ffd-a833e09f95be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158086, "uuid": "0ce87081-9def-4f6b-9a7f-a61aaec0b191", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef470e9-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680161268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161268, "uuid": "30247d9b-3b6d-4735-9a5c-2c18174c0dbd", "comment": "Malware payload (WSHRAT)", "value": "b7582753b05d43a4ee9cbbcbfceaf8a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161268, "uuid": "6fae1d3e-8de7-4c3a-b9be-bd5f9d2c3fbc", "comment": "Malware payload (WSHRAT)", "value": "e73fdc49c9df63e85f36c018109d7bc4e499d74336a44cbf49a364081ccabe41", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161268, "uuid": "7005eb1e-53ed-4033-807e-6be36be6cca8", "comment": "Malware payload (WSHRAT)", "value": "7bb935473294392d9807fbd9755d68c005a5b1b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161268, "uuid": "c8d1bade-77ad-40c6-a0ae-2aa3e70c570e", "comment": "Malware payload (WSHRAT)", "value": "8eabfa67d643aea375a2066b00d36eb5b17bb43622c3b5916fcca9ead5278b4160717fb72dd7097d4e5d91a2e6558327", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161268, "uuid": "17383b29-cfa0-497f-b436-ee79c121541f", "value": "T18E150AC615353A1AA7B3FA24C311E522AC34FD2329D721D2BD847B4EBD768445EBDA30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161268, "uuid": "92dca325-6160-489b-b229-974958c9e27e", "value": "6144:GQ73UwabBqM59zcBkeUDxg36KvDkFuflOqzuNSs16ARjLxHMJB21M1ZIfGVMwQUA:NuF8YxvCxFEdPExFDg0IREIxGxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161268, "uuid": "12ecadba-e0c1-49fd-b86b-42227c00cdb3", "value": 931997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161268, "uuid": "2714bbe8-778d-42da-a609-55a37a05d648", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161268, "uuid": "aba0836a-7bb4-4be2-adec-f1beffb20e87", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac406dbd-ce91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680136057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136057, "uuid": "2e9ad4f1-f4ae-471a-9910-8e29c9ced48f", "comment": "Malware payload (Mirai)", "value": "65f2c525ca73dacc63b62311d108ee39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136057, "uuid": "30ee83ac-0790-4335-a260-f16b542f1da3", "comment": "Malware payload (Mirai)", "value": "e7b75922d54399e25909cd1daac786f96b0cebd556ed4d321fe7be0d186bdfd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136057, "uuid": "65dcae02-217a-465d-9bd2-71c7fef12e0e", "comment": "Malware payload (Mirai)", "value": "2e5e3b8f4920743d0a7e1317b0df82a696f34610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136057, "uuid": "9e091ac9-56b2-4006-8462-d437143fcdf8", "comment": "Malware payload (Mirai)", "value": "e1d4b8fd949a4cfc1ba70d6036e705fe87586bf28c54dfee93cf9670d0ac7c63f8a4cf5f428a5ab1f48e429680a6084a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136057, "uuid": "20dca0ed-be25-40ac-9d34-17966027bdc7", "value": "T160B2D165C6755AC8CDBE0679775F31153480D702D5D4CCE6AEC0B1B25938B147E8C2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136057, "uuid": "4af7d51a-14c2-49e9-9432-4c3265ea4348", "value": "768:oN1s/7uCfDEypkPKpvDIUr3yGNnbcuyD7UyQRjY:oNi/DEi8NUrCGNnouy8yyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136057, "uuid": "721fcff6-0eb5-4c98-8c53-ed2ef2d4c5b0", "value": 24880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136057, "uuid": "2dda1869-7c77-44c9-8e87-34875c81de7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136057, "uuid": "25e8f5e8-2caf-4f5b-9837-1257b317147e", "value": "65f2c525ca73dacc63b62311d108ee39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9422051f-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (NosuStealer)", "timestamp": 1680161357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161357, "uuid": "18b1dfa7-c0a5-4938-8b4b-a7a500e7a975", "comment": "Malware payload (NosuStealer)", "value": "668a82ddc3f1175bd98f5c52513017ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161357, "uuid": "85668baa-a516-4c72-afb8-1f75b06d62e3", "comment": "Malware payload (NosuStealer)", "value": "e86e3725ee0713bcc856d22fdfab010a364681785b8b38bec4aae4078ccf0f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161357, "uuid": "cd88c223-8f2e-46b8-987b-6c72a656b845", "comment": "Malware payload (NosuStealer)", "value": "590e30770b09db992adb0d43da2ba54c098f82d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161357, "uuid": "50d7ba95-0e93-4902-9c13-72ced481eeb6", "comment": "Malware payload (NosuStealer)", "value": "47575796fcb808947f1a007f28abb02bb62795091985cb2b4b36e6e5ee5584dd809a2812b696443d08b3adf2c7230fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NosuStealer", "colour": "#25CC65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161357, "uuid": "cef5c068-643f-4057-861d-b76240a64020", "value": "T11AF49F22F2E18437F1322A789D1B927CDD267E106935E8463FE59E8D5F38681372B193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161357, "uuid": "f93217a7-dda1-4b22-9177-0b9dd0e60a74", "value": "97097c6816d59e0e343951d5da613aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161357, "uuid": "2aaaacc2-3814-4439-9b15-9ccc79c0b892", "value": "12288:zPDiJJG05qrVujzjkv45nG2JoGhkgGt4z93qCb4jyKrxo6EbpYx0:rmb3GVsfkv4I2Wi0t4p4jPG6Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161357, "uuid": "8b323fd3-702d-45b1-858e-1493aa350c40", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161357, "uuid": "b214be33-d05f-4cda-b958-072c43517b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161357, "uuid": "dcf607a6-bfe7-4cc3-9b8f-920aed65899d", "value": "668a82ddc3f1175bd98f5c52513017ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d61c14e-ce93-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680136891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136891, "uuid": "f2d29c7f-2667-459d-9ddb-be6c66573dd1", "comment": "Malware payload (RedLineStealer)", "value": "a76c218a2881480e8ecb0e6bf0de84ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136891, "uuid": "4bb59202-c293-49e8-929b-7fdd6373d3ab", "comment": "Malware payload (RedLineStealer)", "value": "ea2d859bb6d0ece1c10b56605b4a4c89dcd37720eda6b3442763721ff0ac1b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136891, "uuid": "5fc95245-4d21-4afd-ad60-0f124fab2293", "comment": "Malware payload (RedLineStealer)", "value": "a38294291434cacdff03f4099f709ad04161a360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680136891, "uuid": "1f24db30-801c-4424-b8e0-f917226c8c9e", "comment": "Malware payload (RedLineStealer)", "value": "be58938ad5248cc7f05e265956722c3e9b725f59706d1c11719c6970d6c0e5551187912f41623149eeaa13abc9afc6fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136891, "uuid": "8d37d6ba-e5d2-46be-a3c2-3762d4931e58", "value": "T1CC44C0127691C4F2F95F05794912CFB85AEEB8705B118ACB27D406BE4E707E29B3234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136891, "uuid": "0054b385-5e91-4593-88c6-ac7c811ed7c6", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136891, "uuid": "3f3053b7-e09f-47c7-b4d9-9d8f67b923a3", "value": "3072:eHMUt3SJ8XjvXCCLeek9gLbf1Mf4c6fD23wyZBJgW+jnkO7HKUvLPd4peDxmU:BUtJjvXJLeeNLHfoBgaKKUQ0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680136891, "uuid": "db769fea-1b55-440f-9a09-499a30e160bc", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680136891, "uuid": "dd200725-0792-4ee8-92fb-c267ff2874c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680136891, "uuid": "c0010333-4b73-43d0-9fc7-da83966fa6f8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9763ca-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680161260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161260, "uuid": "7a7d73f0-383b-4ef7-b39e-4d9fdb2fe276", "comment": "Malware payload", "value": "d5af2c9d3ed27fa9ebcb70415fbac393", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161260, "uuid": "104e24c6-f36f-448a-a75d-0a8ac29f5037", "comment": "Malware payload", "value": "ea826e56d7413c64d368bd4d1ef717f85ab9bfc51f44acd118d2ef5a36f0aaac", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161260, "uuid": "c4c86689-237b-4e05-9cf9-ec14f8fb3f73", "comment": "Malware payload", "value": "9bbaf70fc5d1aede330ddc48d5c96f3f2f10f721", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161260, "uuid": "5b361575-da55-4973-b4c9-17e9c5b2ad4c", "comment": "Malware payload", "value": "d9e9af7e329d87ac3d8ea354c1175c75f7992be30903dcb94096f1891b0051c0aff8fcdc362727ec2ff4b0b67f5796c8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161260, "uuid": "56235e8b-5bbe-4672-b140-b7cacf1c1233", "value": "T146617A1457EA0308F3F2AB3AA9BE52994E3B3956E932C74E0059414F52F1A40DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161260, "uuid": "b941b5be-5105-4ab9-ad15-38a07a7bfe84", "value": "48:8KHayU9Dmel0iglZ+NslpQfYj1sAT1rTRRSJxodgImcC:8KHMB0+N86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161260, "uuid": "e504024d-2aa7-4631-baa0-0433bcb1c89c", "value": 3468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161260, "uuid": "4a25bb67-6cd6-4bee-8a3e-3a71e1ab731e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161260, "uuid": "0f8968fc-2db6-4182-9c6b-a12c22ae6b41", "value": "Product Design.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7748eb6-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158436, "uuid": "c84a2fc2-c6f0-4612-96db-b5268374097c", "comment": "Malware payload (SnakeKeylogger)", "value": "27a873a35fac60f06f35762aae49fbb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158436, "uuid": "bc43ba8b-bace-4d1e-9c60-921548723b21", "comment": "Malware payload (SnakeKeylogger)", "value": "eab658dc337806cf9d581da4cb44cfdea0a7ed1d9a5007848faeaa0b624fed3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158436, "uuid": "39d5ca26-a27a-4f2e-816d-bd734dfd5b9a", "comment": "Malware payload (SnakeKeylogger)", "value": "9d7c33fdded3f99d263b5a5ede1ad223b1f8a88f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158436, "uuid": "6fd7f2e0-3742-47f2-8f21-9fa92793a4b6", "comment": "Malware payload (SnakeKeylogger)", "value": "a98fa0f6c2504c6bf2cfadb2cc1b903bba19e88c86b218a920cf4738f96f37a0816eb7b0f28ef679c9f7ca1c4146121d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158436, "uuid": "6d75405d-e758-4d5c-ac06-c9408cebac0f", "value": "T12CD46C7C1AFCC556E039D7758BB44C30E7EDB4177A36CE1E79EA00890A26A41768336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158436, "uuid": "d69b3b1e-96b6-4cde-bca4-745d271d6a6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158436, "uuid": "19835356-cd40-499d-a176-c625dc73b123", "value": "6144:0iFagIJ1BpTkP8nQwUnzEC47J722AxAJYC6lk4+pLDkpJmnyvqwVUFYRyq27IM:0RBNk4szE9g24POdkpQyywVUF4fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158436, "uuid": "30771cf5-33df-48ff-a630-4d73d045ffbc", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158436, "uuid": "ab022493-2b64-4fb3-af1e-48eb4d322140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158436, "uuid": "26574567-d733-4244-b589-40d56d5c2126", "value": "Pending invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a1a3e6-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196791, "uuid": "6e2e39a6-317b-4475-833d-89c7b6d25329", "comment": "Malware payload (SnakeKeylogger)", "value": "187b88e8efc323ff9d3402bb6c98641c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196791, "uuid": "1e5371af-dc01-40fb-afbd-a837d3e02cb5", "comment": "Malware payload (SnakeKeylogger)", "value": "eab8143f68fbeca77b863c4315793cd03fd410f06dc5c77812955a0da8fd2359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196791, "uuid": "2d5e3af9-333d-45f4-90f9-accefdcc8461", "comment": "Malware payload (SnakeKeylogger)", "value": "79a06802b0117018f98cf5fa0183dd280e99caf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196791, "uuid": "ec9c4c1a-23c2-4d0b-9a9d-bdfed91f4b38", "comment": "Malware payload (SnakeKeylogger)", "value": "2b184cd82c6a4c5c9a0ee9eb7533b33cab1149d1c59b1c39ff4f7ed9505a9911cabd6a82cd54e13752544fa31d3b92a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196791, "uuid": "9d0d0cb4-3131-4c31-a51b-8916650614b1", "value": "T13F05A324BEEB602EF173EF759AF5BA979A2EFE337F075459109003460A23980DD90539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196791, "uuid": "08d5d4ed-bb49-4fde-9e03-9af2866c7dcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196791, "uuid": "41f50455-fecd-4868-b9e7-55149613feba", "value": "12288:Cy1Q2ngMtm9+0CSi1a/7rEw7G/1Gjdues5j38eFp5bo0+4g58UTVaOJj5BSpPh2U:Su5LaupPh2kkkkK4kXkkkkkkkkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196791, "uuid": "07771a62-b89a-4da9-9666-8ba9e639826e", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196791, "uuid": "b8bac354-f560-481d-85a8-21ca3b8f3ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196791, "uuid": "fdb8ae96-171c-41d0-b28e-ad23d417fb1c", "value": "187b88e8efc323ff9d3402bb6c98641c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f52d1f-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680180665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180665, "uuid": "d45237cf-0709-4ffa-ae46-03e290f4cf31", "comment": "Malware payload (Loki)", "value": "3532c235396299d1c35a11fe00ed0c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180665, "uuid": "50b9e2c7-7e4b-442b-b506-981f13df44e5", "comment": "Malware payload (Loki)", "value": "eb79b1a59f92ad8e0e169dcc1933ac4549831fba69f8d93d8b3694561a606005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180665, "uuid": "40f55882-339d-4f60-a232-7dea5c5fe5c8", "comment": "Malware payload (Loki)", "value": "df28d880b9ebde84ddca6c039b782fc9aee780cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180665, "uuid": "c442dc1d-7436-411a-8f33-137f2b4a4906", "comment": "Malware payload (Loki)", "value": "35a83838ba6baf19b3ff73160e21526193b9ab8c277f2c74fcbe883e24fe7a7d0c857a096d7ac9eded1ead361510d59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180665, "uuid": "45bd6755-fefc-4fee-aa3f-b603bb56a0ad", "value": "T17CD4020AB7007E66DE2B09728817D5D92351BF269BD0A94232C9D33F3621B6783D97DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180665, "uuid": "a61964ba-294b-43de-ad99-cdaf901f426a", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180665, "uuid": "17ecdcb0-e04e-46b4-8174-90137ecd1a3e", "value": "12288:i0bOsuXcpn/eae1pC/aWljTk/T+pcv51rI6ceJs66iI:ihXQ2ae1pEaWlj+TB5dI5eJs66iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180665, "uuid": "018bf657-1190-4bc1-be7d-6ff67b119ffe", "value": 627424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180665, "uuid": "eb31f7fd-fac6-44ad-80b8-7c86064aae83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180665, "uuid": "252c78f3-a4d5-4fec-b0bf-5df4cfaae0c2", "value": "Quotation Request VALENTO\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b38303d-ceaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kangaroo)", "timestamp": 1680146712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146712, "uuid": "573ab9e4-ba07-4964-ae0b-f19591e35ea5", "comment": "Malware payload (Kangaroo)", "value": "0144f94b42e0e4b2d51fd8abf8302aae", "object_relation": "md5", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146712, "uuid": "549136d5-c12e-4d86-ae5c-7827f53dd8a5", "comment": "Malware payload (Kangaroo)", "value": "eb84af704c4ddd27b8b9a5a0116ca9a2b4d9e8a80474fdebf0cc63a6b605223d", "object_relation": "sha256", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146712, "uuid": "51c5f0a8-887a-4ef8-900f-0965ceffa337", "comment": "Malware payload (Kangaroo)", "value": "9aabe52b12c6f8c97b1768325878d40495cca35f", "object_relation": "sha1", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680146712, "uuid": "ea044f3d-39e1-49a6-abea-0fb58c8dc4a5", "comment": "Malware payload (Kangaroo)", "value": "98fc3d9709d3c1cd5880800eaaf5baf3dddd54b675c350a108dc5dea233af731aef45ccea81437ec257e545e69a2fdb8", "object_relation": "sha3-384", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146712, "uuid": "69d125c7-36bf-469f-84b1-e42906e196d5", "value": "T15692D7061FF90A16F6F2DE3054FA6946C57F7C26BB35EACF4A04180819B15A0D5BCBB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146712, "uuid": "09ce8ec0-02ae-4d97-8efc-711bb11aa0b5", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146712, "uuid": "df459c19-c028-42ee-8b12-d012b712867d", "value": "384:19uTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zsKWMQhW5WKGWZQhWY:19u9CaxEovcm/BCvXsviip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680146712, "uuid": "f598079a-a194-4b30-9d49-0c5107ddba28", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680146712, "uuid": "ff48adb4-66c5-484d-a5f3-befe2bfdc05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680146712, "uuid": "2bd2f78e-5296-4618-94a1-a6f5fc7cd069", "value": "2023-03-29_0144f94b42e0e4b2d51fd8abf8302aae_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c7e68c-cf06-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680186423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186423, "uuid": "050f7dce-89fe-46e1-bb20-a7367db469ce", "comment": "Malware payload (Guildma)", "value": "ddb85ab833f534a7b4831232b16dd918", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186423, "uuid": "98b6adec-d8d8-402e-8e4b-3c17c2bd481c", "comment": "Malware payload (Guildma)", "value": "ec47b6663f5618dcce6a3679347b61b43fa64bca6ae7505cd759cf4a9cd7d91a", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186423, "uuid": "fb0f0222-9919-4c82-a6cd-a9f7a744a0f9", "comment": "Malware payload (Guildma)", "value": "9eebb6ebebb00dd016bf1b6579965f0bda8f98e8", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186423, "uuid": "cf6f89f2-364c-41ad-a093-8f9d95bf2888", "comment": "Malware payload (Guildma)", "value": "3f17c286199bc7de5642636a26f5479b1cce40afaa08008cddbf55713af0d3605c82793537522a3911bcbd76e3305fb7", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186423, "uuid": "39f705f9-45d9-4f0b-b115-4030e237323b", "value": "T132E07DADF5956F5DD18D24400C481B8508E82557148D79471F8A76214EADD44651F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186423, "uuid": "fbe525ce-ad81-4750-bb0c-ee2ed1e3df63", "value": "6:SGIfGlkhtncUPiWIjdzbqxL6uOmrgo0zmsXefjXWM5/g4jBXYcZcWgBA9d6:Qgkht4jdzbMLFOmrnom7f7WM64jBh5pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680186423, "uuid": "f38a2de7-e733-4c9d-bb82-2b6b7d295561", "value": 313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680186423, "uuid": "51d1cd75-ae58-4616-9ca2-ca06ead9e31a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186423, "uuid": "9988d2bc-73f5-4a10-8ff8-ae4aa7f6a428", "value": "29_FLUXO_PROJETADO460.413158.79947.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4729890d-cf53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680219210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219210, "uuid": "2245016a-891d-4bee-8d2a-a6ed2787fd16", "comment": "Malware payload", "value": "29835ed466ccc13d014f563c7d750db5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219210, "uuid": "9e78f706-f158-4d2a-ad2b-6a127d4f0388", "comment": "Malware payload", "value": "ed0650eb9d5784d336f42400bbf9da079f4e099401c090fda7dfdc89ed6764ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219210, "uuid": "65832994-868f-4981-8370-1907d4c1f3ab", "comment": "Malware payload", "value": "617b2671bf18760b44b88ddbf986fa5f3689810b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680219210, "uuid": "a74b42d9-8ba9-4bae-94ab-7d41c591c14c", "comment": "Malware payload", "value": "73364e000b4b925b7b1ed1ffd5ca1b3fabe9a3b4b219d142cafe1f26dd0ab171f44417ee8df9ec458f2b08ee6a88be16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219210, "uuid": "17b0f381-e3d4-4280-9ba9-36cc13a419c0", "value": "T1A7351211F2A2C6A7E15619348CD7D3963738BD55AEC1D203326CBB2E7FB93B1DA81205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219210, "uuid": "a0a4ef43-2ab2-4c80-92fa-8875a57bcdfb", "value": "24576:aSYuchKJeclat5QJOjyMzj8qDACPnRGkhDNwSMv7gWVGhWAcgo:kuchyatmcjyej8IAyG0WSMv7gqGhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680219210, "uuid": "a20c167a-d483-4c48-868c-e7b359d1b6c7", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680219210, "uuid": "0941a3c1-ab93-42b1-8767-594efbdf441d", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680219210, "uuid": "493d07e0-0559-407d-b71f-7581bbdd5672", "value": "SecuriteInfo.com.not-a-virus.HEUR.Downloader.MSOffice.Alien.gen.18914.21817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af87e9b-cef2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680177555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177555, "uuid": "b90d84a3-b4e8-4134-a6db-b075a0ec6173", "comment": "Malware payload", "value": "e772f0c46987a10cbd6f14d7a3ec7124", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177555, "uuid": "ca7923e1-28da-43df-ac4f-394a120e523b", "comment": "Malware payload", "value": "ed317791fc9c4e576cf30431343703474bdcf6f962c4e28aa8c7ed13563da8bb", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177555, "uuid": "37899760-b527-4787-bcb4-3d74242f6419", "comment": "Malware payload", "value": "fd232431980c0a531a83bafdcdcdfd6b2ead1140", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680177555, "uuid": "bbb984f2-79ac-4acc-a9c4-bd8fad3d81d2", "comment": "Malware payload", "value": "b3f861ecb459640da54e35bc22d5ce8ec7814d58bc4d66150a9246c09c5ee9437b200c15005e5ddf4470bb0880b1bf38", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177555, "uuid": "22c63587-5f68-49fd-9e8e-f60369274b4c", "value": "T1906512B233449C42D6A1327B0DA9D6366BF29E15558D070636CC7E0FFFAB3D22E1560A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177555, "uuid": "7517b7ac-7c2d-4d3c-b181-2953b31578a1", "value": "24576:VuxnYfyuqYOEzbPDzse2IWZDNjpg2IRezT:Yh+yuOI0z9lNjp8Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680177555, "uuid": "86383145-17c1-4ba4-bcb8-5ea8945fc857", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680177555, "uuid": "601d8979-f520-4087-96e9-a4f1407b9e19", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680177555, "uuid": "9354144a-0e20-4eb3-9c7d-cfe793af281d", "value": "nPerfil de empresa y solicitud de pedido-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a2d6ac-cf24-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680199074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199074, "uuid": "b7fc9486-b05d-409c-bf13-c0fd773d4f12", "comment": "Malware payload (GuLoader)", "value": "14a7895f66e0cb9c00b477baac4f324c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199074, "uuid": "cf442bca-6deb-472c-9f34-14e3c3e13398", "comment": "Malware payload (GuLoader)", "value": "eefa163975eecfca65224623f2ba310e633d98d62e35bd8f0f0a5127ea37a246", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199074, "uuid": "00ac2cd8-b37d-4b2f-a998-49d64b922122", "comment": "Malware payload (GuLoader)", "value": "8806eab80b54f25f47645f49f15f26cb04f604ab", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680199074, "uuid": "7efedfd8-4a8a-4411-b2b2-839ed061108b", "comment": "Malware payload (GuLoader)", "value": "24e4fcf256e70187d911ae771ce9e3b70d91088abbfeb93d7aa2fc06f600c5926085e50e190a2fd0552cbf7c64a47775", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199074, "uuid": "6a10e508-b798-4367-90bc-7a8eb83b9104", "value": "T1D7E42366B530993E30614900463F43272BB937F066E2366D5F46976DC2B8CE5B0B7AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199074, "uuid": "b6b5b6f1-53e6-46d4-ac23-0d9b97cdf789", "value": "12288:PTm0b92HKtXt1pC80ZoYInnitBWarBcufCuyfStzzwW4blUKY6:y0AWxORysCffStyY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680199074, "uuid": "b8fa61d3-14c3-4d2b-8af8-b5dbd105ab5e", "value": 704149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680199074, "uuid": "cc30f3cc-39a6-4948-b479-37104c3b79bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680199074, "uuid": "a0bf92f5-bcfd-4557-a801-e47d8d68c5ec", "value": "495b0122-e196-4271-8992-bc9b22c8a5af.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cad7ae-ced9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680166723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166723, "uuid": "7ee1c21b-4085-438a-a2c9-0b7697eca2c8", "comment": "Malware payload (AsyncRAT)", "value": "93de3df04100f402508d3c0c6cd6b0b0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166723, "uuid": "a3ae867c-a95f-4534-a384-f4d7dacc71f2", "comment": "Malware payload (AsyncRAT)", "value": "ef6a185793a6d6b430ef1a15e01550221919075c5693c80fcea76651e250a14f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166723, "uuid": "88049b56-bb56-43df-8a94-5c8c7ff8dcec", "comment": "Malware payload (AsyncRAT)", "value": "66d8015b249459c284d812a67326a816c5b64fc8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166723, "uuid": "71428151-b5fe-453d-9042-6d3327ed9bd7", "comment": "Malware payload (AsyncRAT)", "value": "8c24aeacb2f1c89455f9c57397124a6b07894f46d877b859fbbaf868410403ef3c7a6f055a96e4e92fffe670f98378b3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166723, "uuid": "3df71d5f-6368-4882-b62c-f4f774aa3b27", "value": "T1E1D4F142F6D284B2D4732A350935BB21A57DBD601E34DE1FB3C47E6DCA75182A231BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166723, "uuid": "625808b6-78ed-40f6-a0cb-877a253f1e51", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166723, "uuid": "54a49813-28a0-42a2-88b0-0f8d2bb1f711", "value": "12288:NcrNS33L10QdrXjCDnuLLcuva9O2VLFUBgYiAehcSPtVOHCCOZPtO3cw:wNA3R5drX2DuzERVvYidPVOoPtO3cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166723, "uuid": "a6083d15-e6fe-4c26-8d6f-c5b9a780b850", "value": 651338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166723, "uuid": "1a9cd93f-4cba-4709-b6fc-30b2a75a9451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166723, "uuid": "562d856a-89e4-4d0a-9928-4f1cf7d986c5", "value": "Pago32220023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cd69f3-cee1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680170359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170359, "uuid": "f81fd514-a593-4e37-b1af-75b34fd7b2eb", "comment": "Malware payload (AgentTesla)", "value": "7b4d587f0d734bdf9e506c89d95f1dd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170359, "uuid": "c955d75f-1b79-4e3b-b2f6-913ecbdf5ea2", "comment": "Malware payload (AgentTesla)", "value": "f02de4746e5703d59c0eacf30735113567b4b4824516181693fd9b00e7623a5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170359, "uuid": "6976bed8-58cb-4f12-820f-c5e2be9298b5", "comment": "Malware payload (AgentTesla)", "value": "a872ab64815977ca7521988c16a12f8e37df40e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680170359, "uuid": "c096e4d4-a9d3-49f3-a8e0-0a645827188a", "comment": "Malware payload (AgentTesla)", "value": "f158ab63c053a8a1f5fdf0ff71824c34c6ca818d51ddb994fb34ce0c8272e607eb38c8223ba081fba2f7551780d35571", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170359, "uuid": "7d65afa7-b7fb-4dec-ac6b-a8147f2f7323", "value": "T14D4208001BDE94F68392E173827A84191ABEE53AB02719E9B0CDD5D637AC30D4BF91F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170359, "uuid": "60e96b0f-d560-4c48-be73-997e9cd40add", "value": "384:UCasjMLihi56diocOxZUSMzvu9lTCc+JB:U56MA37cSyu9Fj+JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680170359, "uuid": "6e143652-9be7-4846-8c11-eaf0906fdb1a", "value": 12758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680170359, "uuid": "3c5f6dd2-da83-4fe7-b1c7-3198d4052b64", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680170359, "uuid": "3006333e-1cb9-418f-9dbf-19d48fe60527", "value": "7b4d587f0d734bdf9e506c89d95f1dd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841d06f1-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680196978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196978, "uuid": "2c98ec6e-8976-4682-8e19-1d4f541e793c", "comment": "Malware payload (Formbook)", "value": "ca9c41409fb6b471bbe34d827fba95db", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196978, "uuid": "9a4a382c-41a6-4fa1-a855-14b89eccfe2f", "comment": "Malware payload (Formbook)", "value": "f06916db4ff1854630b29191f3a41251cdc97ab00a543c777dd5890545cca07b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196978, "uuid": "50b0fa09-5294-4c9b-a862-7059c350cbe4", "comment": "Malware payload (Formbook)", "value": "019fbacb2125688b425dfee241fd7be49e9ee94a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196978, "uuid": "f3c18a00-2ede-4e09-91b2-a7ea8f2d0d33", "comment": "Malware payload (Formbook)", "value": "4c215839a79aec794856f12081b41ad6355dd746d2253107b4b35cdae62d4c8fe89caff0a8c7871ce4fff9d26457ad7d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196978, "uuid": "2777b8f4-f9a1-45ea-ad8d-f58491fdf3e3", "value": "T15B251207D6848E0BDC4387B4AFD769C8231B7D013A9AB9C721047B1F2E72A76E95325D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196978, "uuid": "f9f95a20-676d-4974-be8b-24c40f21b156", "value": "24576:6LKKu9VRu9VQ+MXUiu9V2ho51lOQy6qN2U:6LKKuJuY+MXPuMVQyyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196978, "uuid": "553c94e9-1b4c-4d17-8585-d84dfde1f8f2", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196978, "uuid": "9ca4f0fd-39b8-48ab-8342-606602f2a3fb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196978, "uuid": "cb4126fa-1db5-4300-8a29-9dd563ceb8fe", "value": "3710157828.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170f38e9-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680196795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196795, "uuid": "9e4ee000-a032-466e-8fe7-035f29d6ef0b", "comment": "Malware payload (SnakeKeylogger)", "value": "f37da92e2748a92b5e642bb4c4e81f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196795, "uuid": "1fecc27b-0f10-4ba6-b89b-70f8a9b7cf0a", "comment": "Malware payload (SnakeKeylogger)", "value": "f097925aea69618c8358fef529676ec3809e480399643c7c1cca5c25cc03bceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196795, "uuid": "4a9fcd4d-1d6f-4959-bf78-2f8d754d3503", "comment": "Malware payload (SnakeKeylogger)", "value": "dec1439bf49eae643052e5e2740c304de3beb9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196795, "uuid": "76b89cf0-381f-483a-b85d-c86f8eeadabc", "comment": "Malware payload (SnakeKeylogger)", "value": "8174494afc5f119636d0c0c3b02e445aa9634923f33010a1871a6067b5afe43fc4f9ac4c21af991c11e7b85fadddd522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196795, "uuid": "56ed282a-f525-4122-b7f7-21fd932b9db3", "value": "T109D4F11036D9D70AC02A97BDC1E4D1B0A7BACC98D252CB134FC9BC87B3DF3166A65196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196795, "uuid": "9e4c75a7-312d-40d6-9cbf-f50215c1690e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196795, "uuid": "b691e68e-e9db-46c7-addd-e6c82453489f", "value": "12288:bzg02C1VCK7Brmh4dOGPDYRX+KkjS5y3yBLdlc/QoimOMt+b:bU61MWBSYk8Oy32robimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196795, "uuid": "817d85b8-d832-45a8-8475-324c3f839a1d", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196795, "uuid": "896f1820-25f0-492f-9ee7-4ea97e6808b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196795, "uuid": "183a572b-2b49-4ab1-9e12-c2a724cfaf85", "value": "New Inquiry - Future Link General Trading Company.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eab3e46-cecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680160703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160703, "uuid": "54bd80dd-2223-406b-b4bd-3d416981bf82", "comment": "Malware payload (AgentTesla)", "value": "f2a6ee2f2f9a13b6477fe4ac85988631", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160703, "uuid": "753fdd99-584c-44b0-bd54-22eef697ff80", "comment": "Malware payload (AgentTesla)", "value": "f11c9ea5e66eff2891f885da8c803482b04f2cc4cd8cd61fe9890e9252a009ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160703, "uuid": "b40ace7e-f62d-4d01-b901-50ba17ebed77", "comment": "Malware payload (AgentTesla)", "value": "5f65f7f34f1515c5dc4fbda99633989f36af22e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680160703, "uuid": "3934a267-a85d-48ef-863c-768203e728d2", "comment": "Malware payload (AgentTesla)", "value": "770ee03becb3bd26ee64cce4634c15a4843a5701133b6bd9e51122b1c2ad325cb1034641d3bc711007caad9229cf2b6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160703, "uuid": "b296b570-2223-4273-9a34-68f5a24e270b", "value": "T12B2533F292CC0CEB9DDB355DAC3E64C969D8D840A5C0B452D87B859D1BED3A047F28B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160703, "uuid": "3ecfdd3e-2a05-4a36-8a0e-4d4626dc56bc", "value": "24576:N9ICRMLQLgNQrAnJj3reZXkWKfHSH1JTwGHiCmQEtv2+:Y8Zgy0nxbeXKvSHPTtnEtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680160703, "uuid": "25a3c91f-46a6-4b7e-9e26-80107c9820a7", "value": 964285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680160703, "uuid": "55689546-d2ec-4045-84c2-a21ed0e51435", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680160703, "uuid": "d0622ac3-09cc-4875-a659-a66f6de0afb6", "value": "Purchase Order_30323.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702f0f83-cf07-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680186637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186637, "uuid": "0c1e1f60-e73a-4471-8df3-b3eb1a455b10", "comment": "Malware payload", "value": "251658deca6970f2412e182eca1aff5b", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186637, "uuid": "5e141def-f2ba-46b2-abee-1a5c61b992bd", "comment": "Malware payload", "value": "f2cbacd915456e47e8801353dce4cfdbfe2aeeaf6d5a8adaeaa325d0c30d00fc", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186637, "uuid": "d9da3645-5847-447b-9dca-d6348a5bcbf4", "comment": "Malware payload", "value": "7be806a1ef3839e2a772f2c13c8bf6f13b77eb70", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680186637, "uuid": "62887107-87d4-4ec8-9539-a0c0c05ec310", "comment": "Malware payload", "value": "4ab0708dea660f51dcff50a26b03b4c3714266d4bb598b3babc6d09f4fb55e725ec03b8be283fe475bdef85ad3a9ee3d", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186637, "uuid": "82d69a37-bb76-48e7-9ffd-22311654cd72", "value": "T1FF6602F11193FDC4A72F1D4881043E40EC042A6B976C925CFDC926BB93EA558EFAD9B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186637, "uuid": "dadca83c-a50d-4883-9cb3-4c57f6781cb9", "value": "49152:hEwUKsFMIow42dH3zMJccuI/MEUjAkgxKoiogSogsfAC0h3Q18A3XwEdPTSqCuv0:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680186637, "uuid": "d85cd31d-4eeb-44ad-b913-6483cbd5e552", "value": 6738944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680186637, "uuid": "76aa3249-20e3-49f9-8195-d7bb941f9b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680186637, "uuid": "ce2dbe59-4ab2-4237-9c5a-21aecc222105", "value": "251658deca6970f2412e182eca1aff5b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f04891c-cf1c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1680195574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195574, "uuid": "09d978dd-7988-46a7-8f81-e9bd611a1191", "comment": "Malware payload (DarkCloud)", "value": "696cc5675e5739ea80ef220253226fee", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195574, "uuid": "951740f4-344c-4a8c-9bf9-8cf414c53548", "comment": "Malware payload (DarkCloud)", "value": "f37bd7b0b40ed2a3272e82a58e4662afacf1a30448743b7d2b5750ed601e3e86", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195574, "uuid": "9ee0602f-a7d3-48eb-8d4b-f4bca72ff5c1", "comment": "Malware payload (DarkCloud)", "value": "d9746f8d1d98da010eeba5e5f5d6a5b0170dbc20", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680195574, "uuid": "cfa5c38f-5e35-4223-b602-f747f5bfb4b0", "comment": "Malware payload (DarkCloud)", "value": "5b471c2baded8f30d0b44e9a1b6d9ae4a48ebbc8f792666ab4752d62e5307ba6f59caf20d5c5e760ec9c9e1235fdef7e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195574, "uuid": "fa14b349-be23-4b11-ab84-473c66561f30", "value": "T10E25336CDCFFF6A88EBE313F404D145EB66C12E23D948E9AFE9958C64341CB14A444B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195574, "uuid": "c9677160-8e8a-41d7-8ee9-72023f891fdd", "value": "24576:+sROBBndE7IrFJsjDbq/+wnzRYY1yy+NUFjI1j:+jBBb7BpzRYY18qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680195574, "uuid": "8435d306-e38a-423c-a8c0-decd80ebba94", "value": 981746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680195574, "uuid": "955c92a8-52a6-4409-bc80-97c0d5490782", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680195574, "uuid": "ab88db09-2868-4842-bdb0-661b047599ab", "value": "Purchase Order Specifications for March-2023 update.pdf (253K).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f540e73c-cedc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680168392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168392, "uuid": "883b58c0-c645-4c6a-a64f-ea24a073e5a8", "comment": "Malware payload (AgentTesla)", "value": "6ed649d0c104c49ca0860b86268ade72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168392, "uuid": "7c9aa27f-1b3a-422d-9b22-6f27da0d1ae8", "comment": "Malware payload (AgentTesla)", "value": "f388b5e3cf8b41bf483a00dcd8d53cc02c298ec970510f68190e33992b184440", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168392, "uuid": "bde38138-28da-42db-93b2-8c650fc757e4", "comment": "Malware payload (AgentTesla)", "value": "1070fde85bf28fdeb33255f257f8097b0d7bbfee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680168392, "uuid": "5b0c8518-4fb9-4dcb-bd15-dbaa1c6befe8", "comment": "Malware payload (AgentTesla)", "value": "6a16d27b0de06ee954fea61f519ce9d47d6b35aaf72f24e090a14995ef9ba9d3483ae90ea5a2951fe17fd57b20797ccd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168392, "uuid": "74f7d6eb-4007-4c55-82c8-2c9c156fa667", "value": "T1E105F10A3BADA902C2495A39C5E7552403B269432373D7457DC606951E0FBEAACCFBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168392, "uuid": "2ab0aba0-cf7d-438d-ad6f-a8b4dcc1342c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168392, "uuid": "6d3e99da-990f-4af8-bfec-60469df3f582", "value": "12288:Um6Fhabqd0fHIEaRpU33i2/ku1a1o+ieILBN8e8WmbaCVLw7zW0uyF32g5mKI1bf:URt0cRpUHdHBNX2aaw7zjwgOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680168392, "uuid": "d092b460-0c26-4883-b4b1-35512b2044dc", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680168392, "uuid": "68594ee6-d40d-4909-aac3-9e7f2e1af010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680168392, "uuid": "f6fea470-f33a-4583-8aa9-874592e9a432", "value": "Enq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bad294-cee7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680172909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172909, "uuid": "8a63300c-94b9-4702-be26-fd8ca86975b6", "comment": "Malware payload (AgentTesla)", "value": "bf6e7ddff7bf957553ac390178728581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172909, "uuid": "01f8f8d6-bc82-4d52-aaa9-5756e37965d2", "comment": "Malware payload (AgentTesla)", "value": "f3caeea10bc33fbf3a105e0b10998ab1053e95a0df9a9ebdee936f4ac6f1e8d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172909, "uuid": "37398b56-9025-4cce-956f-7e50f673eb5e", "comment": "Malware payload (AgentTesla)", "value": "2fd0f25edb546046a6b52412e98f1c563493e87c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680172909, "uuid": "8f9a18c8-ad50-4abd-8a72-f26e43d70e07", "comment": "Malware payload (AgentTesla)", "value": "ef7a55e08c0120eab4b857297b74ac86994e129d6ceb81bdcc5188cabfa0801c8a632917445a03ee820abd4882e50626", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680172909, "uuid": "37cfbb94-6c08-4d1e-9376-c74041c22083", "value": "T131B423D9D72C9009E57E4E110382FD3336061058AD7AF0C65F4CDF569EB26BAAD81E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680172909, "uuid": "db688ad3-23f8-4b45-b714-d23b5097eadc", "value": "12288:OvTiqu42mOMHQbGeGnuih+MGcUheRTzRHb:O9ulVbrRK+MG3eRTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680172909, "uuid": "0bb3e6b5-2730-4df6-850e-fce3e9aa751a", "value": 494249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680172909, "uuid": "5cedebd6-27c1-403a-9816-2d9c7ee47b1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680172909, "uuid": "98f7e42d-f49b-4d51-83e6-758fdeb0102c", "value": "$57,000.00.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1448c2-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158449, "uuid": "217ffa68-d14d-463a-8536-c4dc38477a96", "comment": "Malware payload (SnakeKeylogger)", "value": "17ee9d82c44cd045f784ef2f354389f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158449, "uuid": "86f89e93-e784-48ff-a1ef-b4123b9ae31a", "comment": "Malware payload (SnakeKeylogger)", "value": "f4b21e57bb6fabca1dd4b5499d5940749346c350975dcc07cf8f40db0376acfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158449, "uuid": "bda3ca77-958f-4fe9-93e8-95a4b1b55285", "comment": "Malware payload (SnakeKeylogger)", "value": "8f8fd503adac7464ba891180f6e26f95dbed1990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158449, "uuid": "b8d01de6-cdca-4e6b-b915-e21714c9afc1", "comment": "Malware payload (SnakeKeylogger)", "value": "2da7c76fa2c565ffb971509a2d4d4345e4051a99ba727a2a2c8934a7de577734be53795f05bca7197624b8e542b51310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158449, "uuid": "26a911fd-45c7-480c-b449-2814b14f8dfa", "value": "T192156ED1B190C89AED6B05F1AD7AE53021A7AE9C94A4810C56DDBF1776F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158449, "uuid": "24fe9240-a5d9-4480-b19d-688bcf7b86f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158449, "uuid": "87fb1607-0047-480c-ad00-a650d1efb894", "value": "12288:JeJ/sI3tsh6/+7QCfEt7PFahwix2jj+5iMSNjumVL5adldgo1imOMt+L:3M2kGe7PcrxG0uNjumV1a5pimXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158449, "uuid": "c87fbc14-882f-4bc2-9ba2-f07184667704", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158449, "uuid": "bf560129-cf16-4822-9fa0-7accdc1d35a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158449, "uuid": "4dba1669-ad2c-46fe-ad37-550793a69c1c", "value": "RFQ-4320018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea166ce-cecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680161562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161562, "uuid": "81416910-df91-4226-be22-d0bc58cdd2fc", "comment": "Malware payload (AgentTesla)", "value": "2b564516caf1e0e77e93c3d154281f16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161562, "uuid": "2b09c4d0-8160-40d4-8a74-07bb40a48193", "comment": "Malware payload (AgentTesla)", "value": "f4d76f6893e4996666f0bbb670ad59bfd7201356080b213015621449c0aa2710", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161562, "uuid": "3ff45665-cb67-43e6-9a28-d01a6aa03b46", "comment": "Malware payload (AgentTesla)", "value": "fdb405c650f80a7067d1ae7d33ddbed9d0b27dd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161562, "uuid": "0a2778d7-7b36-4970-bfc8-6c57d13da016", "comment": "Malware payload (AgentTesla)", "value": "2954a687992bcc2fdbb478198f870b617bc6322789f3aaaf36bf2ab014abe18fbb895d8dde17e7d9cf58dbdbdd31cba7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161562, "uuid": "4a3307e3-0257-4fef-acdc-4fa47485b9de", "value": "T10215AF3D3E6EB5D2F175F271EBD18222EBE39ED3A912DD4A15D2038C4602752B88315E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161562, "uuid": "33a764a2-18cc-43dc-b3e0-3d20d35bbcbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161562, "uuid": "deef3e4c-3da2-449c-9ba3-81051f329ebc", "value": "12288:nc2TJ+aMCZzHAe2AG7WtrYhhcA9D/4BjDtmABdVefwFCz1IROdFiMSdg7QCLe5ba:nT8YZzHA9Z0rYhkBhd3Fwa0FfSdgfLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161562, "uuid": "ed623ef9-cecf-441b-993c-3211e1ca8f7a", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161562, "uuid": "6cd6aff7-51fb-416a-a4c1-90b101c39946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161562, "uuid": "45428a65-c7ba-4476-a1bd-263f3b160fb2", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cb695e-cede-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1680169111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169111, "uuid": "10535f99-cd32-4175-ae9d-cc47148d6c0b", "comment": "Malware payload (STRRAT)", "value": "a346b67d4e19298c8735f6da7d31bab5", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169111, "uuid": "2e25621f-119a-47dc-b978-29e040daef35", "comment": "Malware payload (STRRAT)", "value": "f6321a8e4667a139c6dbb860c5b2a2b41d14ef9d4c98fc1745cce7ad181ca07f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169111, "uuid": "d15c4244-9d56-4c68-a50c-4b101ae9144f", "comment": "Malware payload (STRRAT)", "value": "80a9f706b1714ab703b494bbddbbe26c60d7798f", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680169111, "uuid": "023c8f04-28d5-496e-a19d-132ef17a95f9", "comment": "Malware payload (STRRAT)", "value": "e8c5381e150b9c23446335fdd0b212aca9fafb4ecb554e5149d9bead86c334a626bdcc6e7e0b2aa8a9be163cdf3f5230", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169111, "uuid": "6a1259ec-d1da-4ad2-98fc-ea76c6037a77", "value": "T1682423D413ADFD235492F36CFB5647390234F16464CA8E1921FAC27A3684866BAA53CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169111, "uuid": "5f30b4a9-50d2-4608-8c77-292fb8207375", "value": "6144:KWbOm4Y/zUvSo9AuZdUzHcEMxP42qZiCz:KByUr9AuZdUAEMxQ2qZiCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680169111, "uuid": "ae2f979c-9329-4f1e-a2d3-d0cd9425d843", "value": 222667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680169111, "uuid": "411f9bf2-0d9d-499b-b429-53bbdc43f94f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680169111, "uuid": "24a5bfd4-944a-42d1-aaf8-602d49e13ecc", "value": "Payment Prove And Revised New Order PI.300611941.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb08c834-cec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680158442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158442, "uuid": "f5e01b45-ac8f-4b27-922a-6a96da553a4e", "comment": "Malware payload (SnakeKeylogger)", "value": "2224d84e4d75b85aa447e2a0bb5bfdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158442, "uuid": "71994c65-2dbd-47d5-a1eb-7117ad572444", "comment": "Malware payload (SnakeKeylogger)", "value": "f72a28baaee398dbbd65efbdae0cf4864f208f806f4592f8f6bb7c9a735c2362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158442, "uuid": "3e299778-037b-4521-97dc-39d223dda5ac", "comment": "Malware payload (SnakeKeylogger)", "value": "f9afd500770a423c06ea55122f26c510626fd391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158442, "uuid": "5b61d09d-a8af-4358-a95e-cdea7358706a", "comment": "Malware payload (SnakeKeylogger)", "value": "d384836dd9efa8168915fcbc1b996676a3219b3eabd5518cede534e277b762c35029d015e9588fb555d53e4cf102d74f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158442, "uuid": "f64c185f-3981-4e5a-87d1-a17a2c0fb1c7", "value": "T115D4012036EDC119C626877A81F4C1B0177ADCC1D979CBA35FCABC87B3CE7492625196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158442, "uuid": "83f0f038-fcb2-414b-85d5-4af35554d503", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158442, "uuid": "6b61d6be-cd89-429b-89c4-7ae6fec1ce4b", "value": "12288:IeJ/sIAglhcnUwW+g35AX1MsrAOqWls5Rqc81vNIumLsqZjItimOMt+j:Nyn/WSFMJXWlBvNzmgqZjOimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158442, "uuid": "dd4ef2f8-0be5-4add-9c13-46bf40eb3618", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158442, "uuid": "333a1a34-1b41-490c-a015-6ae7be0a9ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158442, "uuid": "12f75e23-1420-49ca-aaaa-db0019f44136", "value": "Statement of Account.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8aa72c-ced3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680164240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164240, "uuid": "09eda279-217e-4254-bc15-d6fdc91a54c7", "comment": "Malware payload (AgentTesla)", "value": "8a6d4cd6627e266bee2d70465262156f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164240, "uuid": "03ed3e63-7933-44eb-995a-51e2fd4c3b5e", "comment": "Malware payload (AgentTesla)", "value": "f796a5fa2f821bdd1c34be128f9a000b75862ec27648daf4ef5a77b38490d624", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164240, "uuid": "3d39f833-4d68-4de2-8190-9d9b7e6339d0", "comment": "Malware payload (AgentTesla)", "value": "7509dfe4f65003fc66dd1d327b5c6ce3034ae974", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680164240, "uuid": "f0ea42c6-be4f-491d-a037-a4635a925c08", "comment": "Malware payload (AgentTesla)", "value": "d56840d04f7baf4ae69331308c500dd3eeb026a3366136b8e3a58443651f2aeae15dfe967b9db0d4a593ce2cc0c583de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164240, "uuid": "b39cf019-38e0-4765-90ad-cd12a1ada313", "value": "T1A215094227F5CA0BF1EE9B75A87021140BF4E98AAAB7D74F1946F5E81862F005D413BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164240, "uuid": "ba046b30-298c-4c24-9c9a-07a5ff60ef6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164240, "uuid": "bc972426-c891-434e-9967-68de8d586b08", "value": "12288:8f4LZ9Svfg34LJ7m9tk2Ln9EqXD8BQkdMdPSgZHrItdp4:Gg3+JeXIBRMdPSgZHWdp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680164240, "uuid": "d7075de8-24d6-4cf1-834a-73275977c22f", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680164240, "uuid": "c5b5cefd-fdc4-4d52-b42e-69e550d58668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680164240, "uuid": "3e5391b6-fad4-457f-81bd-0e5311ab5e24", "value": "ARG5N5889.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef730cb-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680180595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "8d477092-84e9-464d-9257-f60c291137ea", "comment": "Malware payload (AgentTesla)", "value": "7022e0b1a25cfa577d9a11439164353a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "b7f9eaa6-324a-4e7b-a396-7e2f38575603", "comment": "Malware payload (AgentTesla)", "value": "f7dbab3b0071eb8088183b768b7936149ef74693b07820db05bcd6b377b0b474", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "884debe9-2c99-41f7-ac36-628328d78954", "comment": "Malware payload (AgentTesla)", "value": "f18adda2b5dd25fc26d4282a95f30db6b350d7b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "8298837f-3fbd-41b4-bb6e-7a9d217f4d6e", "comment": "Malware payload (AgentTesla)", "value": "79b89ff966868a8bf2abd162bf447d886ba98edf10a7c8d69910a0352f44b408d6ea95e124167c16af1cc5976698f312", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180595, "uuid": "a45c3a35-bf77-4178-9263-6d3f8ddb6cfc", "value": "T1E845E0C132944593FA6956B196B38DB007723F1D4BA6EBCA3CDE349326F37804518E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180595, "uuid": "ea4aceed-10ad-4f6e-9f7d-982308187f49", "value": "12288:5Qw8m/eoBcBWYwywwpyuTdHEnyzW8M1s9d8fYf9/Ksq/KsI/Ks:NNBcBWYYwD+KW8HkMtio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180595, "uuid": "1c223480-9a33-4af4-842f-6be748b95e5b", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180595, "uuid": "9f7dc05e-d213-4c57-abe0-26a9d15c7d12", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180595, "uuid": "cf50894e-21c5-4e56-b8b1-190a3609c6d0", "value": "STB60NF06T4.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2f8b17-ced8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680166309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166309, "uuid": "3915beae-6288-45fd-9240-92246bc47f3d", "comment": "Malware payload", "value": "6601a4a1db3b960aec93dd05fe07b848", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166309, "uuid": "ceb4b27d-1970-4e0b-8b45-546fae84b995", "comment": "Malware payload", "value": "f9c7dd489dd56e10c4e003e38428fe06097aca743cc878c09bf2bda235c73e30", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166309, "uuid": "ab28feac-09db-43b4-ab69-77c53311db80", "comment": "Malware payload", "value": "1640ce33699442d511335f1639619d30d6058075", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680166309, "uuid": "7addd159-20e1-4d46-a97c-5de6d3d3cb44", "comment": "Malware payload", "value": "57ace69e312aa3f5795ce2f84f63fe7bdce79ad0f7e6fe6c218704d9fb882d91e47e055691e85eaad6d0f039a08c2b91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166309, "uuid": "dc9af714-a639-47de-8ec4-dbb2bac20e6f", "value": "T16F327C03E3EC8199F5368776A5B38224163AF891996AC7CF97E4009E0C21B708D13BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166309, "uuid": "6bb36a66-cea1-494b-a415-48c43a410ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166309, "uuid": "51087e68-1a8b-445c-b85f-8a98f0430db8", "value": "192:2b9Tfo5tM78mbYqSWIuZKNxDIkuUN3QeY/7:2b9em78KMdhlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680166309, "uuid": "326fe466-e182-4936-8b3c-1ef79fababb4", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680166309, "uuid": "637270ba-e248-45ef-8427-807e40b65748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680166309, "uuid": "bbb40786-0afd-4958-8404-fef81afd5a5a", "value": "dcloader.ex_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cd7fd5-cec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680158732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158732, "uuid": "2836a160-a007-478e-9419-d5ba4fe89c2e", "comment": "Malware payload (Loki)", "value": "a3b0daf59ad3e6d2e465ea72ea83c4e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158732, "uuid": "5376f8a3-0329-442d-a733-d0c08bab45ef", "comment": "Malware payload (Loki)", "value": "fa1276a654a6f969dbe586b09ca9d1a460158de4519eed4698a7feb1f42c16d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158732, "uuid": "351a370c-c69b-437e-86e8-e7a8fa819cac", "comment": "Malware payload (Loki)", "value": "4b47ec0894f937f54956d0e083002314851fe569", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158732, "uuid": "2e381a4c-5995-4290-95b7-dac2a080ce21", "comment": "Malware payload (Loki)", "value": "a137ec65e377009f6c19fa60f1adefb1bf3aef9e5965fe9095d61a89619635a13b12e25d3ab14a517f67bcf0f06793fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158732, "uuid": "24141c29-86de-42f8-aa70-2f0fde118abf", "value": "T1AA245B025EE07870F61E46728E1EC2F8BB1EB860DE15BF5A1679DE2F09F11B1D262705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158732, "uuid": "f653d050-8ef0-4de5-adb5-5df87ded8ffc", "value": "6b53dd8377bb37d70af2675681b94658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158732, "uuid": "6debfe60-c950-4b0e-98dc-b2bbc3bb48c5", "value": "3072:30j9EObKm9RB+6wxbLtyzeaL0ws69i1pnqfCHTaWdcRI9pyOeY:EevK+1dcs69i5zaD+9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158732, "uuid": "df2b0054-5076-4766-82eb-01d59a3bee7c", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158732, "uuid": "72d0a282-9edd-44a7-80e8-863d76e13642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158732, "uuid": "71507b64-dc68-4cb8-a833-6f40746f0d36", "value": "a3b0daf59ad3e6d2e465ea72ea83c4e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d094e96-cecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680161372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161372, "uuid": "feaee760-c660-4cf6-b311-a2f0acc97bc1", "comment": "Malware payload (Loki)", "value": "d5f0ef9117cc9d999a8f3ce34aae265a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161372, "uuid": "1475d552-4cc9-41d0-bd7a-fada8c27e058", "comment": "Malware payload (Loki)", "value": "fa3e5f3e92113edc46947e33ba2f42b48bae7bc2a3e3be6de5c03a3faddd5bc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161372, "uuid": "bc719f61-ce14-423e-8f14-6b5b0dcbad54", "comment": "Malware payload (Loki)", "value": "d8204cd30a68778628836d1641a2d7ee6ab364e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680161372, "uuid": "ce830da8-9f1b-40ad-a19b-ca22a1fd5e72", "comment": "Malware payload (Loki)", "value": "c975b39101ba8f48ed04303d70f3aeebc7d27f14da8c621018c73679ac632a335a4a65c5b8b6b46b03cff680b4228844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161372, "uuid": "d9c8a126-8c8b-415e-a966-602cf2bad818", "value": "T1A3D4019436ED811AC665833981F5C271637ACCC8EA79CB631FDEBC8BB2CE3564025197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161372, "uuid": "50712d75-96cc-4b0d-94f6-37432c742050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161372, "uuid": "145a7b2e-0dcc-4237-82b3-9f61d310d3e2", "value": "12288:BeJ/sI+u4Yh53lKgZE2SvNFcFURAviVJbAyO93/qYlxI9/0ffJUEYXsDze01fniW:YVbIgZE2SHAqVJkyWyZZ0wieGfnimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680161372, "uuid": "7c6542c3-715b-4ce3-9623-f54504c860c7", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680161372, "uuid": "c3043107-b94b-47fc-a6b0-dc1a5b2552d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680161372, "uuid": "58330efc-f35e-4e1b-be0c-8c2b261a2eaf", "value": "d5f0ef9117cc9d999a8f3ce34aae265a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a680631-ceda-11ed-88f6-42010a9c006e", "comment": "Malware payload (Grandoreiro)", "timestamp": 1680167246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167246, "uuid": "7dc7cac2-aa8e-4a25-85b9-a41434d577a5", "comment": "Malware payload (Grandoreiro)", "value": "1eec76d149464a0ddde558b9867ee1f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167246, "uuid": "d2c4d16a-b2f4-4bc8-a3cb-44f4c7d471bf", "comment": "Malware payload (Grandoreiro)", "value": "fa62a8cc511d051499e8609344f7edba8bb2034f4ac732deb8fbc9599356a767", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167246, "uuid": "de20feaa-d4a8-4bed-8bfe-7b049c4f06d5", "comment": "Malware payload (Grandoreiro)", "value": "a46c1b1ea806e8ac7e13759dec03e63e516b3018", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680167246, "uuid": "5b1ca274-d658-4fab-8972-6e62a632a965", "comment": "Malware payload (Grandoreiro)", "value": "34484e1311837460c985a385286fe6e6838ebf7653f7ae144b2396b94764302614ca80b318cde67a8129641ddeb20b86", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167246, "uuid": "9d196ad9-b4cc-43dc-9f03-ce5de5b59bc5", "value": "T1BB57F3391DBE013790A5CAF9CFC6986BF410E2B731612D3668E257988716E9339C317E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167246, "uuid": "de6be2f4-63a5-4b8f-b641-89a53e0c9165", "value": "f5c1fc997a9ff8fd54a44db9c2445b0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167246, "uuid": "e0184b71-0934-4e38-9eb7-42ae46640a96", "value": "393216:XxLQMQ9zIAcfQ4EScuKctwpCKch2iLxTaRetMfrjCA9Dt6S7Rxmj2o1Lu9AC:BqocpxpCjssMfrjCwtLRTou9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680167246, "uuid": "52a4dd25-fa49-4c2e-9b1e-6207a2461a98", "value": 27810304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680167246, "uuid": "ac73c327-4619-4bbc-b8b2-c9eea2c630f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680167246, "uuid": "034c7014-4c39-4f8f-9769-5b365a8288c2", "value": "zlibai.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94aac86b-cf05-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680185839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185839, "uuid": "8667b6a9-e0eb-41f7-a62a-bbe862fc4b40", "comment": "Malware payload", "value": "f0d2d28570c0a3fc365813684d179532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185839, "uuid": "938e051f-becb-47b6-a2d6-d8ad506ac4fa", "comment": "Malware payload", "value": "fb39c7edcc62343328d983a28ba958d0c67b8a3903ea0228a97f4f1f5ead01ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185839, "uuid": "42a5eedd-2397-4ace-9f7e-8bad120a4ece", "comment": "Malware payload", "value": "0dd8ca85234ece102e5c2674b2af3ce57695169b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185839, "uuid": "9f678322-cd5b-49eb-a365-47375cf49546", "comment": "Malware payload", "value": "3ede7c4ccc8fb24f66d0282ea8f520300b3d7bdb46bf88ea5d7424615d188e74db70a1d0f6eec565e039bffeddc81cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185839, "uuid": "7e7c8509-0b9b-4415-8dd5-e52d45ecfd02", "value": "T15705F0583DBBDD32E3EE5BB9A091812467F6830AD686EB81700810A4DC477DBCA1757F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185839, "uuid": "75fadf76-13a7-4300-8c73-cd3be04e0f11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185839, "uuid": "e021499f-e23c-437f-8034-22046919b643", "value": "24576:7WvoXUSWrZQg2Q9NXw2/wPOjdGxYuDLJtK40q++:78fTq24GjdGSuDY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185839, "uuid": "f74cf4df-e24b-40ab-98e2-edf522d9b632", "value": 851304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185839, "uuid": "50b21bcd-d3f3-4b61-9ccc-9d6a15cdf583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185839, "uuid": "07f639d4-a9f7-4af2-aaf8-df3adbfa8f54", "value": "fb39c7edcc62343328d983a28ba958d0c67b8a3903ea0228a97f4f1f5ead01ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f36cafe-cef9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680180595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "fd95c401-c453-4f11-9c16-4ce623b224b4", "comment": "Malware payload (GuLoader)", "value": "0f607ada4eb3397b1df8c14c3907e5e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "740fae5e-825f-4d17-86f8-df03d2ce4c81", "comment": "Malware payload (GuLoader)", "value": "fbfdc2c6f3d5576d236a010ee6b87edf61cfc06382acc9c5a1f4c3286a6b7378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "cdfa4944-2cf5-4a06-953a-087694f34353", "comment": "Malware payload (GuLoader)", "value": "9bdc3632f763b1f457d7911c66ad5dd549c46751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680180595, "uuid": "0e0fea48-816c-4c6d-9762-0b6b16af3c8e", "comment": "Malware payload (GuLoader)", "value": "aa7be08065d40406a867e8c2fcf9779cd432900252cc956163467237e074c5de8c808c19e24a83a6a08932e032bb56cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180595, "uuid": "243e0f90-56c2-45f7-9445-d6312d5e548e", "value": "T1304522117E42D973D5220A710CB3E17163B2EC99AA63430B23E07F2FB97A25359169FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180595, "uuid": "19d2ff56-50ec-4ecc-a020-427b34b7605a", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180595, "uuid": "8b6d0f35-0d37-4638-a035-096e711e6cfc", "value": "24576:nO/lnSVsiwc+fCSbU9GDJ+WXgsUOp6H1W5tp0UNJ8gc+8my:nunChibY9GDJHUOUVKtKU38X5my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680180595, "uuid": "13c045ee-d028-474e-95bb-7c5cb936466c", "value": 1277600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680180595, "uuid": "b35f0b8a-a536-4ea9-ac6e-33e4b12abd4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680180595, "uuid": "4dc46579-fefa-46a6-9163-e5ba1e78d740", "value": "Bemaerke.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccbe5ea-cf03-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680185128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185128, "uuid": "b1dcfbc5-46e6-40c0-acb0-a5f03344da74", "comment": "Malware payload", "value": "ab887dcdf950282db2f43af0e8471d87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185128, "uuid": "54b1e2b5-8d81-46e9-aece-886ba89a7674", "comment": "Malware payload", "value": "fe89a23ba4354518052429a3fe9fc7784b498a9d954f448df6d339fd8d669f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185128, "uuid": "af6fc20e-ece7-4e10-a823-7d22e14ec96b", "comment": "Malware payload", "value": "4b098c21cfaf433f8f6128cb7cb939ab787f1c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680185128, "uuid": "d4866a3a-8821-4b76-bcca-6e89129feac6", "comment": "Malware payload", "value": "531af1ceee0949d007420de3134bea0e48a541acea8a8c3762dfbf9d1ea71f1c77b0fd54f19378b5dd251811662dcf6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185128, "uuid": "536e07a3-1282-425c-89c2-552e519833e3", "value": "T13EA633782777EC97FB51BDB24B399FAB76B9C07056EB2E5883F005CAB0418D20A14758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185128, "uuid": "4418ea90-4a71-4f54-9008-21ea248859f0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185128, "uuid": "8a17e9d0-26db-4aac-9459-9b596fcf041d", "value": "196608:YwMEbaUFaSxGExE04P76yy8qkfFieF2+cOoiWNNFTNKnozZNgkzg:YwMKaU7xX204JyNkfpoDNdNRzZNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680185128, "uuid": "309a1708-7c7f-49ba-942a-5f848ec469dd", "value": 10407475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680185128, "uuid": "22c171f8-d077-4755-8900-b3b8f7a14a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680185128, "uuid": "9539efab-a4ea-4765-a65f-00268e4f213c", "value": "fe89a23ba4354518052429a3fe9fc7784b498a9d954f448df6d339fd8d669f55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8575473c-cf1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680196980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196980, "uuid": "a3ffabaf-b379-48db-ad82-63e8dce1f8c4", "comment": "Malware payload (Formbook)", "value": "668e2c619f737ab2cb47a655c234cb93", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196980, "uuid": "db354bf9-77b0-4414-b169-134bbc022d9c", "comment": "Malware payload (Formbook)", "value": "feeebcac4fe92741d3bf232e0f87568893aab96802565d59b10b744991b373dd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196980, "uuid": "df46d0ba-3551-4b8b-a657-a8d93892456a", "comment": "Malware payload (Formbook)", "value": "d0d8070ce9cc1af1925aea236254ef77c327d49a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680196980, "uuid": "d735b276-4180-4cc6-9c86-e91a4238e7a7", "comment": "Malware payload (Formbook)", "value": "552e9e462cdac0e8c50fc9bb62cfd3d24551c4395c8596fe2404cffd2dd3c3d67d7937ce145065a58de97b1848f76089", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196980, "uuid": "0753521d-5767-4c7d-8f3e-7da521b7ba39", "value": "T12575121BD7944D0EC88747B0ABA7789C131F7D013A9EB48220057B5F2EB2E29F657359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196980, "uuid": "1c11bb5c-c916-4e38-9bec-a7187eaf3e90", "value": "49152:ZLKxfuBujueuW+MXCun+MXBuU+MXI3CNaNY:NaO4dmECVEBgEISI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680196980, "uuid": "9a314d02-d03f-486a-a815-64655c1a60b2", "value": 1607168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680196980, "uuid": "f65e0a41-9e6e-4244-8892-c22c271a01b2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680196980, "uuid": "5a85a7a0-197e-4011-b154-d9add7cc0c03", "value": "AWB_FAN_647538359325.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8652a900-ced0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680163052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163052, "uuid": "f0ceff17-9ef5-4cfa-8579-3615168edc83", "comment": "Malware payload (AgentTesla)", "value": "6158ecd02f7630d99b26459180c2a7bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163052, "uuid": "c2efd7f5-e2bf-4cd5-a872-2ce439d15a94", "comment": "Malware payload (AgentTesla)", "value": "ff07810d580c976def3d586faed2bdf6937d10ea3e76de225e6cb62d2e0f4522", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163052, "uuid": "356af424-5364-4942-baa9-0f4afccdff5c", "comment": "Malware payload (AgentTesla)", "value": "168a0182126633144c97b9b5b279621c5de671cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680163052, "uuid": "bb017685-1ba1-4e2c-be5d-393b99008ce4", "comment": "Malware payload (AgentTesla)", "value": "95604890e39a536f9ef57d5fa38bad8844b69b8f517572d22efcfb526ea47dd665bdef3e98d4ec658f54ddd70efca80c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163052, "uuid": "3a9224a6-a66f-4f56-a9ab-5bb0c4b0f039", "value": "T18615F162F0505595DFA647F028968864D2FE7CED4B71EA0DBD8A728702F3392059FA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163052, "uuid": "a2b34a18-c79d-47e2-9afa-2bab2f35e256", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163052, "uuid": "5b206020-598e-4214-a56c-c2219b98be6b", "value": "12288:QUJB0O/kyR/U+BC+lvwRrAagV1Tichw+Fz+5RjRXnX+aSXbWT+5xEGQHUJhZxBZr:51PUQ/vwAN1Zhw+85cXbWaQHyD9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680163052, "uuid": "092038fe-e22f-4546-ba23-b9c79b355d50", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680163052, "uuid": "c8a92638-d654-467a-92d1-b41429e349fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680163052, "uuid": "ec06830d-6698-4ed8-bf3b-121e212b602b", "value": "108 itens.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb87ef5-cec4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680158046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158046, "uuid": "5093dfc7-ea79-478c-9b05-716a0707a886", "comment": "Malware payload", "value": "47f0ab3ffb5f9931cf0fde1505e8892b", "object_relation": "md5", "Tag": [ { "name": "47f0ab3ffb5f9931cf0fde1505e8892b", "colour": "#10856B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158046, "uuid": "be249792-898a-466d-a85b-b559f192133e", "comment": "Malware payload", "value": "ff21e829fc200dc50fb455f4a09536647249c6ce010cd7f4b07179bf7bd20c60", "object_relation": "sha256", "Tag": [ { "name": "47f0ab3ffb5f9931cf0fde1505e8892b", "colour": "#10856B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158046, "uuid": "92854e85-4ee8-44e2-8aae-13b72616d335", "comment": "Malware payload", "value": "693131865a411ca9b351745ba755144298fcb0ee", "object_relation": "sha1", "Tag": [ { "name": "47f0ab3ffb5f9931cf0fde1505e8892b", "colour": "#10856B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680158046, "uuid": "cf39fe9e-a2fd-414f-989f-301ea08add51", "comment": "Malware payload", "value": "2083ba5eadb4fd8de9ecd55199405b6e49a8d0266127341e7759cb1713683fc19f44428ecad7516a9b5c503be09500e4", "object_relation": "sha3-384", "Tag": [ { "name": "47f0ab3ffb5f9931cf0fde1505e8892b", "colour": "#10856B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158046, "uuid": "f917578a-8b3a-4c46-94d3-e734b1eca7e0", "value": "T1E38633017DC26C73D4A708723A3AAF35253CBE502F389EDBB7A5075ED9214D0E6A9394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158046, "uuid": "ae703c6f-5b7a-4e81-9136-456d6a09aabd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158046, "uuid": "b24eb6c7-5cae-4ca7-94f3-070007b38271", "value": "196608:kd/VHW1tUoND40hrlU3fRqfjXmaKc4fVVHPl:KNHWjdPlTbXmLbVHPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680158046, "uuid": "fc04feaf-c919-40bf-b65e-dcf2d91b0e94", "value": 8574646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680158046, "uuid": "b79012e7-22ec-4b9a-a63e-5aac67387ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680158046, "uuid": "9507b1f3-c316-4e5a-8a5d-499533190452", "value": "47f0ab3ffb5f9931cf0fde1505e8892b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e48924c-cf13-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680191653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191653, "uuid": "e25b20c8-848a-4633-8cb3-f745dd361ef8", "comment": "Malware payload (Guildma)", "value": "76957cc762189d0d0c74bebfb36770dd", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191653, "uuid": "2aa0fea9-2bab-4ee8-b5df-74369a2bd2c7", "comment": "Malware payload (Guildma)", "value": "ffaba7f69cf1dc62af5d97eeb88cc2b8fc0b8f8fba74141c6ea56d45ac81b9e3", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191653, "uuid": "6ab8a81d-984c-4931-b2a8-c8b755151fbc", "comment": "Malware payload (Guildma)", "value": "3c6648896db2885f3863d830fbdc1a1f675ddeaf", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680191653, "uuid": "ada2b7e8-5ec3-4227-bca6-fad796f7d84a", "comment": "Malware payload (Guildma)", "value": "12ec557577aba8876a47326c637b7fec1afaa4b4ccf80504586a749498e0669dc9f6c76331e53b3a24cc64f918ef574c", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191653, "uuid": "e4bb977e-0b5c-4a64-9cc6-1c01df115b2f", "value": "T1BE4248CE684F40D76AA8B4C7A46DC01C53B94BFD5DC8CC6D6D28DCE9B84832519ECA32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191653, "uuid": "899ad7a1-a500-411e-9a1a-cdac4121344a", "value": "192:E+CPtOLt4a/d0CRkuZQ0LHDFryCDL7tX8p3DTTpFZUcBBBQOG:E+P/d0CRkua0LHDFryWL72F6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680191653, "uuid": "e48c2d9a-d466-436e-83b4-c8c298f8996b", "value": 12498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680191653, "uuid": "28fb35c8-3a5a-434b-a92a-20e415ecbbf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680191653, "uuid": "4763acda-61a3-49c3-a105-20e8b2fd2d35", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }